CVE-2025-62276

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-62276
The Document Library and the Adaptive Media modules in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions uses an incorrect cache-control header, which allows local users to obtain access to downloaded files via the browser's cache.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62276 Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:liferay:digital_experience_platform:7.4:*:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:2023.q3.1:*:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:2023.q3.2:*:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:2023.q3.3:*:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:2023.q3.4:*:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:2023.q3.5:*:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:2023.q3.6:*:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:2023.q3.7:*:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:2023.q3.8:*:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:2023.q3.9:*:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:2023.q3.10:*:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:2023.q4.0:*:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:2023.q4.1:*:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:2023.q4.2:*:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:2023.q4.3:*:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:2023.q4.4:*:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:2023.q4.5:*:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:2023.q4.6:*:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:2023.q4.7:*:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:2023.q4.8:*:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:2023.q4.9:*:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:2023.q4.10:*:*:*:*:*:*:*
cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*
History

18 Oct 2026, 21:10

Type Values Removed Values Added
Summary
  • (es) La biblioteca de documentos y los módulos de Medios Adaptativos en Liferay Portal 7.4.0 hasta 7.4.3.111, y versiones antiguas no compatibles, y Liferay DXP 2023.Q4.0 hasta 2023.Q4.10, 2023.Q3.1 hasta 2023.Q3.10, 7.4 GA hasta la actualización 92, y versiones antiguas no compatibles utilizan un encabezado cache-control incorrecto, lo que permite a los usuarios locales obtener acceso a archivos descargados a través de la caché del navegador.
Information

Published : 2025-11-01 00:15

Updated : 2026-10-18 21:10

NVD link : CVE-2025-62276

Mitre link : CVE-2025-62276

CVE.ORG link : CVE-2025-62276

JSON object : View

Products Affected

liferay

  • liferay_portal
  • digital_experience_platform
CWE
CWE-525

Use of Web Browser Cache Containing Sensitive Information