CVE-2025-62256
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
Liferay Portal 7.4.0 through 7.4.3.109, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.7, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions do not properly restrict access to OpenAPI in certain circumstances, allowing remote attackers to access the OpenAPI YAML file via a crafted URL.
Risk Assessment
Unauthorized access to the OpenAPI YAML file may reveal API details such as endpoints and data structures, potentially facilitating further attacks. This is a confidentiality breach and may lead to escalated threats.
Recommendation
Update Liferay Portal/DXP to a patched version (e.g., the latest available) or apply a workaround to restrict access to OpenAPI. Also review security configuration.
Other vulnerabilities in Liferay Portal/DXP
See all- CVE-2025-43773Critical
Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP in the listed versions has a security vulnerability allowing improper access through the expandoTableLocalService. This may allow unauthorized access to data or functions.
- CVE-2025-62275Medium
Blogs in Liferay Portal 7.4.0 through 7.4.3.111 and older unsupported versions, as well as Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92 and older unsupported versions, do not check permissions for images in a blog entry. This allows remote attackers to view images in a blog entry via a crafted URL.
- CVE-2025-62261Medium
Liferay Portal 7.4.0 through 7.4.3.99 and older unsupported versions, as well as Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 34 and older unsupported versions, store password reset tokens in plain text. This allows attackers with database access to obtain the token, reset a user's password, and take over the account.
- CVE-2025-43763Medium
A server-side request forgery (SSRF) vulnerability exists in Liferay Portal 7.4.0 through 7.4.3.131 and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, and 2024.Q1.1 through 2024.Q1.20 affecting custom object attachment fields. This flaw allows an attacker to manipulate the application into making unauthorized requests to other instances, creating new object entries that link to external resources.
Original NVD description (English source)
Liferay Portal 7.4.0 through 7.4.3.109, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.7, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions does not properly restrict access to OpenAPI in certain circumstances, which allows remote attackers to access the OpenAPI YAML file via a crafted URL.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS