CVE-2025-62257

Password enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions allows remote attackers to determine a user’s password even if account lockout is enabled via brute force attack.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62257	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:liferay:digital_experience_platform::::::::
	cpe:2.3:a:liferay:digital_experience_platform:2023.q3.0:::::::*
	cpe:2.3:a:liferay:digital_experience_platform:2023.q4.0:::::::*
	cpe:2.3:a:liferay:digital_experience_platform:2024.q1.1:::::::*
	cpe:2.3:a:liferay:digital_experience_platform:2024.q1.2:::::::*
	cpe:2.3:a:liferay:digital_experience_platform:2024.q1.3:::::::*
	cpe:2.3:a:liferay:digital_experience_platform:2024.q1.4:::::::*
	cpe:2.3:a:liferay:digital_experience_platform:2024.q1.5:::::::*
	cpe:2.3:a:liferay:liferay_portal::::::::

History

18 Oct 2026, 00:10

Type	Values Removed	Values Added
Summary		(es) Vulnerabilidad de enumeración de contraseñas en Liferay Portal 7.4.0 hasta 7.4.3.119, y versiones anteriores no compatibles, y Liferay DXP 2024.Q1.1 hasta 2024.Q1.5, 2023.Q4.0 hasta 2023.Q4.10, 2023.Q3.1 hasta 2023.Q3.10, 7.4 GA hasta la actualización 92, y versiones anteriores no compatibles, permite a atacantes remotos determinar la contraseña de un usuario incluso si el bloqueo de cuenta está habilitado mediante ataque de fuerza bruta.

Information

Published : 2025-10-30 00:15

Updated : 2026-10-18 00:10

NVD link : CVE-2025-62257

Mitre link : CVE-2025-62257

CVE.ORG link : CVE-2025-62257

JSON object : View

Products Affected

liferay

liferay_portal
digital_experience_platform

CWE

CWE-307

Improper Restriction of Excessive Authentication Attempts

{"id": "CVE-2025-62257", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-62257", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-30T14:08:10.447289Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "security@liferay.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security@liferay.com", "affectedData": [{"vendor": "Liferay", "product": "Portal", "versions": [{"status": "affected", "version": "7.4.0", "versionType": "maven", "lessThanOrEqual": "7.4.3.119"}], "defaultStatus": "unaffected"}, {"vendor": "Liferay", "product": "DXP", "versions": [{"status": "affected", "version": "7.4.13", "versionType": "maven", "lessThanOrEqual": "7.4.13-u92"}, {"status": "affected", "version": "2023.Q3.1", "versionType": "maven", "lessThanOrEqual": "2023.Q3.10"}, {"status": "affected", "version": "2023.Q4.0", "versionType": "maven", "lessThanOrEqual": "2023.Q4.10"}, {"status": "affected", "version": "2024.Q1.1", "versionType": "maven", "lessThanOrEqual": "2024.Q1.5"}], "defaultStatus": "unaffected"}]}], "published": "2025-10-30T00:15:34.907", "references": [{"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62257", "tags": ["Vendor Advisory"], "source": "security@liferay.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@liferay.com", "description": [{"lang": "en", "value": "CWE-307"}]}], "descriptions": [{"lang": "en", "value": "Password enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions allows remote attackers to determine a user\u2019s password even if account lockout is enabled via brute force attack."}, {"lang": "es", "value": "Vulnerabilidad de enumeraci\u00f3n de contrase\u00f1as en Liferay Portal 7.4.0 hasta 7.4.3.119, y versiones anteriores no compatibles, y Liferay DXP 2024.Q1.1 hasta 2024.Q1.5, 2023.Q4.0 hasta 2023.Q4.10, 2023.Q3.1 hasta 2023.Q3.10, 7.4 GA hasta la actualizaci\u00f3n 92, y versiones anteriores no compatibles, permite a atacantes remotos determinar la contrase\u00f1a de un usuario incluso si el bloqueo de cuenta est\u00e1 habilitado mediante ataque de fuerza bruta."}], "lastModified": "2026-10-18T00:10:00.123", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5F7BCC0B-5F36-4E6B-AABE-61B88E9A99D8", "versionEndIncluding": "7.4"}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:2023.q3.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B7B3A5E2-23CE-45A8-BD01-77024EB9F9A9"}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:2023.q4.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B5CE3202-2723-44A6-B63F-061138287FDA"}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:2024.q1.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "84E1655E-87BB-4490-8F65-EE8686546DF6"}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:2024.q1.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "93A7FEFE-C60F-42E8-82BA-30015A4D476D"}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:2024.q1.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FFA76949-2A0E-4786-968D-46CEEC4DC97C"}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:2024.q1.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3FF38EA6-313C-4008-AC47-EA17F7F82D80"}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:2024.q1.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B9516741-5C31-41AB-B53E-9E42A145AF89"}, {"criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1451AFB7-E0CC-40E1-9A92-0F7EC0AFA72F", "versionEndExcluding": "7.4.3.120", "versionStartIncluding": "7.4.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@liferay.com"}