GHSA-8hw3-ghwv-crfh
NoneCVSS
—
EPSS
—
Published
Oct 30, 2025
CISA due date
—
The record
Liferay Portal vulnerable to password enumeration
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | com.liferay.portal:release.portal.bom | 7.4.0-ga1 | 7.4.3.120 |
| maven | com.liferay.portal/release.portal.bom | 7.4.0-ga1 | 7.4.3.120 |
Related vulnerabilities
- CVE-2025-62257 Liferay Portal vulnerable to password enumeration Same vulnerability
- CVE-2025-62264 Liferay Portal Vulnerable to Reflected XSS via the selectedLanguageId Parameter Also affects com.liferay.portal:release.portal.bom
- GHSA-56jv-4ww3-65mw Liferay Portal is vulnerable to XSS in the Blogs widget Also affects com.liferay.portal:release.portal.bom
- GHSA-f5vh-4rj2-w8r8 Liferay Portal is vulnerable to DNS rebinding attacks Also affects com.liferay.portal:release.portal.bom
- CVE-2025-62265 Liferay Portal is vulnerable to XSS in the Blogs widget Also affects com.liferay.portal:release.portal.bom
- CVE-2025-62266 Liferay Portal is vulnerable to DNS rebinding attacks Also affects com.liferay.portal:release.portal.bom
- GHSA-gh4w-8qgq-8w9r Liferay Portal Vulnerable to CSRF in Headless APIs Also affects com.liferay.portal:release.portal.bom
- GHSA-gv7w-jh8g-vr73 Liferay Portal Does Not Limit Access to APIs Before Email Verification Also affects com.liferay.portal:release.portal.bom