CVE-2025-62247

Missing Authorization in Collection Provider component in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19 allows instance users to read and select unauthorized Blueprints through the Collection Providers across instances.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62247	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:liferay:digital_experience_platform::::::::
	cpe:2.3:a:liferay:digital_experience_platform::::::::
	cpe:2.3:a:liferay:digital_experience_platform::::::::
	cpe:2.3:a:liferay:digital_experience_platform::::::::
	cpe:2.3:a:liferay:liferay_portal::::::::

History

18 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Autorización faltante en el componente Collection Provider en Liferay Portal 7.4.0 hasta 7.4.3.132, y Liferay DXP 2025.Q2.0 hasta 2025.Q2.9, 2025.Q1.0 hasta 2025.Q1.16, 2024.Q4.0 hasta 2024.Q4.7, 2024.Q3.1 hasta 2024.Q3.13, 2024.Q2.0 hasta 2024.Q2.13, 2024.Q1.1 hasta 2024.Q1.19 permite a los usuarios de la instancia leer y seleccionar Blueprints no autorizados a través de los Collection Providers entre instancias.

Information

Published : 2025-10-22 20:15

Updated : 2026-10-18 21:10

NVD link : CVE-2025-62247

Mitre link : CVE-2025-62247

CVE.ORG link : CVE-2025-62247

JSON object : View

Products Affected

liferay

liferay_portal
digital_experience_platform

CWE

CWE-862

Missing Authorization

{"id": "CVE-2025-62247", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-62247", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-23T17:30:50.814505Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "security@liferay.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2.0, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security@liferay.com", "affectedData": [{"vendor": "Liferay", "product": "Portal", "versions": [{"status": "affected", "version": "7.4.0", "versionType": "maven", "lessThanOrEqual": "7.4.3.132"}], "defaultStatus": "unaffected"}, {"vendor": "Liferay", "product": "DXP", "versions": [{"status": "affected", "version": "2024.Q1.1", "versionType": "maven", "lessThanOrEqual": "2024.Q1.19"}, {"status": "affected", "version": "2024.Q2.0", "versionType": "maven", "lessThanOrEqual": "2024.Q2.13"}, {"status": "affected", "version": "2024.Q3.1", "versionType": "maven", "lessThanOrEqual": "2024.Q3.13"}, {"status": "affected", "version": "2024.Q4.0", "versionType": "maven", "lessThanOrEqual": "2024.Q4.7"}, {"status": "affected", "version": "2025.Q1.0", "versionType": "maven", "lessThanOrEqual": "2025.Q1.16"}, {"status": "affected", "version": "2025.Q2.0", "versionType": "maven", "lessThanOrEqual": "2025.Q2.9"}], "defaultStatus": "unaffected"}]}], "published": "2025-10-22T20:15:37.780", "references": [{"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62247", "tags": ["Vendor Advisory"], "source": "security@liferay.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@liferay.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "Missing Authorization in Collection Provider component in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19 allows instance users to read and select unauthorized Blueprints through the Collection Providers across instances."}, {"lang": "es", "value": "Autorizaci\u00f3n faltante en el componente Collection Provider en Liferay Portal 7.4.0 hasta 7.4.3.132, y Liferay DXP 2025.Q2.0 hasta 2025.Q2.9, 2025.Q1.0 hasta 2025.Q1.16, 2024.Q4.0 hasta 2024.Q4.7, 2024.Q3.1 hasta 2024.Q3.13, 2024.Q2.0 hasta 2024.Q2.13, 2024.Q1.1 hasta 2024.Q1.19 permite a los usuarios de la instancia leer y seleccionar Blueprints no autorizados a trav\u00e9s de los Collection Providers entre instancias."}], "lastModified": "2026-10-18T21:10:00.120", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A7CD6797-2A1B-4621-98A0-07A2F03ED4EB", "versionEndExcluding": "2024.q1.20", "versionStartIncluding": "2024.q1.1"}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0EB4ABE4-0B4D-471C-A868-0CA6F5EE7A47", "versionEndIncluding": "2024.q2.13", "versionStartIncluding": "2024.q2.0"}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "81DE8039-B5BF-4747-A426-DCA1FFC8D960", "versionEndIncluding": "2024.q3.13", "versionStartIncluding": "2024.q3.1"}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FB83F0DC-CD4C-4C2F-AEB5-98ABB73428A1", "versionEndIncluding": "2024.q4.7", "versionStartIncluding": "2024.q4.0"}, {"criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8FA15ADB-E7D6-4F24-9A06-F281746CBF06", "versionEndIncluding": "7.4.3.132", "versionStartIncluding": "7.4.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@liferay.com"}