Skip to content
OpenAdvisories
High WID-SEC-2025-2419 7 CVEs

Liferay Portal und DXP: Mehrere Schwachstellen

Published Oct 27, 2025 · Updated Oct 27, 2025 · de-DE

Vendor: Liferay Product: DXP Product: Portal Platform: Linux Platform: macOS Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Liferay DXP und Liferay Portal ausnutzen, um falsche Informationen darzustellen, Informationen offenzulegen, Code auszuführen, ein Cross-Site-Scripting auszuführen oder einen Denial of Service herbeizuführen.

Product

Liferay DXP (Digital Experience Platform) ist eine erweiterte und kommerziell unterstützte Version von Liferay Portal, die zusätzliche Funktionen und Dienste bietet.
Liferay Portal ist eine Open-Source-Webplattform für Unternehmen, die ein Framework für die Erstellung und Verwaltung von webbasierten Anwendungen und Inhalten bietet.

Vulnerabilities 7

  • High 7.1
    CVE-2025-62260

    Liferay Portal Vulnerable to DoS via Crafted Headless API Request

    Liferay Portal 7.4.0 through 7.4.3.99, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions does not limit the number of objects returned from Headless API requests, which allows remot…

    Liferay DXP Portal com.liferay.portal:release.portal.bom Maven
  • High 7.0
    CVE-2025-62258

    Liferay Portal Vulnerable to CSRF in Headless APIs

    CSRF vulnerability in Headless API in Liferay Portal 7.4.0 through 7.4.3.107, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to execute any Headless API v…

    Liferay DXP Portal com.liferay.portal:release.portal.bom Maven
  • Medium 6.9
    CVE-2025-62253

    Liferay Portal Vulnerable to Open Redirect via the _com_liferay_layout_admin_web_portlet_GroupPagesPortlet_redirect parameter

    Open redirect vulnerability in page administration in Liferay Portal 7.4.0 through 7.4.3.97, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported vers…

    Liferay DXP Portal com.liferay:com.liferay.layout.admin.web Maven
  • Medium 6.9
    CVE-2025-62259

    Liferay Portal Does Not Limit Access to APIs Before Email Verification

    Liferay Portal 7.4.0 through 7.4.3.109, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions does not limit access to APIs before a user has verified th…

    Liferay DXP Portal com.liferay.portal:release.portal.bom Maven
  • Medium 6.9
    CVE-2025-62261

    Liferay Portal Stores Password Reset Tokens in Plain Text

    Liferay Portal 7.4.0 through 7.4.3.99, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 34, and older unsupported versions stores password reset tokens in plain text, which allows att…

    Liferay DXP Portal com.liferay.portal:release.portal.bom Maven
  • Medium 4.8
    CVE-2025-62263

    Liferay Portal Vulnerable to Cross-Site Scripting

    Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.3.7 through 7.4.3.103, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 service pack 3 through update 36 allow remote attackers to inject arbitrary web script or…

    Liferay DXP Portal com.liferay:com.liferay.account.admin.web Maven
  • Medium 4.6
    CVE-2025-62262

    Liferay Portal Vulnerable to Information Exposure Through a Log File Vulnerability in LDAP Import Feature

    Information exposure through log file vulnerability in LDAP import feature in Liferay Portal 7.4.0 through 7.4.3.97, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older uns…

    Liferay DXP Portal com.liferay:com.liferay.portal.security.ldap.impl Maven

Revision history

  1. #1

    Initiale Fassung

References