CVE-2025-62275
Full vulnerability record from the local CVENow database.
Description
Blogs in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions does not check permission of images in a blog entry, which allows remote attackers to view the images in a blog entry via crafted URL.
Severity
MEDIUM
CVSS score
6.9
(v4.0)
Vulnerability status
Analyzed
Source identifier
Published
2025-11-01 03:15:31.757000
Last modified
2026-10-18 21:10:00.120000
View original CVE JSON
{
"id": "CVE-2025-62275",
"sourceIdentifier": "[email protected]",
"published": "2025-11-01T03:15:31.757",
"lastModified": "2026-10-18T21:10:00.120",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Blogs in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions does not check permission of images in a blog entry, which allows remote attackers to view the images in a blog entry via crafted URL."
},
{
"lang": "es",
"value": "Blogs en Liferay Portal 7.4.0 hasta 7.4.3.111, y versiones anteriores no compatibles, y Liferay DXP 2023.Q4.0 hasta 2023.Q4.10, 2023.Q3.1 hasta 2023.Q3.10, 7.4 GA hasta la actualización 92, y versiones anteriores no compatibles no verifica el permiso de las imágenes en una entrada de blog, lo que permite a atacantes remotos ver las imágenes en una entrada de blog a través de una URL manipulada."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Liferay",
"product": "Portal",
"defaultStatus": "unaffected",
"versions": [
{
"version": "7.4.0",
"lessThanOrEqual": "7.4.3.111",
"versionType": "maven",
"status": "affected"
}
]
},
{
"vendor": "Liferay",
"product": "DXP",
"defaultStatus": "unaffected",
"versions": [
{
"version": "7.4.13",
"lessThanOrEqual": "7.4.13-u92",
"versionType": "maven",
"status": "affected"
},
{
"version": "2023.Q3.1",
"lessThanOrEqual": "2023.Q3.10",
"versionType": "maven",
"status": "affected"
},
{
"version": "2023.Q4.0",
"lessThanOrEqual": "2023.Q4.10",
"versionType": "maven",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2025-11-03T15:47:43.985392Z",
"id": "CVE-2025-62275",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-863"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:*:*:*:*:*:*:*",
"matchCriteriaId": "8E19E344-92B4-4B46-BD89-25EC7191972C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:2023.q3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1EF6451A-2A5D-4222-A1C6-113AA4B8D4E6"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:2023.q3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "9D6CE430-3C95-4855-BA44-E2E136D1FEB2"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:2023.q3.3:*:*:*:*:*:*:*",
"matchCriteriaId": "44FEB149-C792-493D-B055-568FFC96298A"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:2023.q3.4:*:*:*:*:*:*:*",
"matchCriteriaId": "B050DD73-71B6-46CD-A35B-7ACB53BE6C6A"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:2023.q3.5:*:*:*:*:*:*:*",
"matchCriteriaId": "62432289-E1DC-4013-85C7-6B77299A910F"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:2023.q3.6:*:*:*:*:*:*:*",
"matchCriteriaId": "0912EEFE-DC56-43F6-AE0E-A4E2A033F3C5"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:2023.q3.7:*:*:*:*:*:*:*",
"matchCriteriaId": "9398F679-5F47-4DF2-AA91-4A21126675C6"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:2023.q3.8:*:*:*:*:*:*:*",
"matchCriteriaId": "8296B54A-976A-404C-AB77-0619E4297A69"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:2023.q3.9:*:*:*:*:*:*:*",
"matchCriteriaId": "F778EB15-2AB0-44C1-BD99-9F7F1851E167"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:2023.q3.10:*:*:*:*:*:*:*",
"matchCriteriaId": "625E6C10-D0C7-4C5D-99F8-601A7B942392"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:2023.q4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B5CE3202-2723-44A6-B63F-061138287FDA"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:2023.q4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "A27A8480-7EE1-4265-9117-D6C234ACAC5F"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:2023.q4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "94425688-725E-41DC-B2D3-14F2A7163AD6"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:2023.q4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "623CA096-BDBB-4F59-B734-07FB405800CE"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:2023.q4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "30B27CBE-14BA-4EBB-8B74-91DD1228A1F5"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:2023.q4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "81EDBB1C-9EBB-4FAD-ADAC-B5A890BB3F50"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:2023.q4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "658B4C0D-D8A2-40DF-87BE-A2E148082BB7"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:2023.q4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "9C3DD89D-A40C-4C31-B698-A23C4A6F243E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:2023.q4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "C785189B-09C0-4395-A8C5-4C548836B08C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:2023.q4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "C436962A-5DAC-4843-9EE9-3E18F1524BE0"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:2023.q4.10:*:*:*:*:*:*:*",
"matchCriteriaId": "DFCAE569-D95A-4635-8E92-5142A7C70F51"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*",
"versionStartIncluding": "7.4.0",
"versionEndExcluding": "7.4.3.112",
"matchCriteriaId": "2D6470C7-9D36-43F3-86CB-B79ED9EA53F4"
}
]
}
]
}
],
"references": [
{
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62275",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
}
]
}