CVE-2025-62244CWE-639

CVE-2025-62244

Medium · published October 13, 2025

CVSS v3.1
4.3
EPSS
0%
Percentile
20.0
In the wild
Unconfirmed
What it is

Insecure direct object reference (IDOR) vulnerability in Publications in Liferay Portal 7.3.1 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92, and 7.3 GA through update 36 allows remote authenticated attackers to view the edit page of a publication via the _com_liferay_change_tracking_web_portlet_PublicationsPortlet_ctCollectionId parameter.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00286 · 20.0th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2025-10-13T21:15Z
Affected products (5)
ProductVersionsFixed in
liferay/digital_experience_platform≥ 2023.q4.0, < 2023.q4.62023.q4.6
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/liferay_portal≥ 7.3.1, < 7.4.3.1127.4.3.112
liferay/digital_experience_platform≥ 2023.q3.1, < 2023.q3.92023.q3.9
References (1)
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62244 · [email protected]
EPSS history
Timeline
  • 13 OCT 16:53Z
    Insecure direct object reference (IDOR) vulnerability in Publications in Liferay Portal 7.3.1 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5…
    cvelistv5