CVE-2025-62275
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
Blogs in Liferay Portal 7.4.0 through 7.4.3.111 and older unsupported versions, as well as Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92 and older unsupported versions, do not check permissions for images in a blog entry. This allows remote attackers to view images in a blog entry via a crafted URL.
Risk Assessment
Remote attackers can access images in blog entries they should not have permission to view, potentially breaching content confidentiality.
Recommendation
Update Liferay Portal/DXP to a version containing the fix. Until then, consider restricting access to blog entries containing sensitive images.
Other vulnerabilities in Liferay Portal/DXP
See all- CVE-2025-43773Critical
Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP in the listed versions has a security vulnerability allowing improper access through the expandoTableLocalService. This may allow unauthorized access to data or functions.
- CVE-2025-62261Medium
Liferay Portal 7.4.0 through 7.4.3.99 and older unsupported versions, as well as Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 34 and older unsupported versions, store password reset tokens in plain text. This allows attackers with database access to obtain the token, reset a user's password, and take over the account.
- CVE-2025-62256Medium
Liferay Portal 7.4.0 through 7.4.3.109, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.7, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions do not properly restrict access to OpenAPI in certain circumstances, allowing remote attackers to access the OpenAPI YAML file via a crafted URL.
- CVE-2025-43763Medium
A server-side request forgery (SSRF) vulnerability exists in Liferay Portal 7.4.0 through 7.4.3.131 and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, and 2024.Q1.1 through 2024.Q1.20 affecting custom object attachment fields. This flaw allows an attacker to manipulate the application into making unauthorized requests to other instances, creating new object entries that link to external resources.
Original NVD description (English source)
Blogs in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions does not check permission of images in a blog entry, which allows remote attackers to view the images in a blog entry via crafted URL.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS