CVE-2025-62252CWE-639

CVE-2025-62252

Medium · published October 14, 2025

CVSS v3.1
4.3
EPSS
0%
Percentile
18.0
In the wild
Unconfirmed
What it is

Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions allows remote authenticated users in one virtual instance to assign an organization to a user in a different virtual instance via the _com_liferay_users_admin_web_portlet_UsersAdminPortlet_addUserIds parameter.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00269 · 18.0th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2025-10-14T01:15Z
Affected products (4)
ProductVersionsFixed in
liferay/digital_experience_platform≤ 7.4—
liferay/digital_experience_platform≥ 2023.Q3.1, ≤ 2023.Q3.10—
liferay/digital_experience_platform≥ 2023.q4.0, < 2023.q4.62023.q4.6
liferay/liferay_portal≥ 7.1.0, < 7.4.3.1127.4.3.112
References (1)
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62252 · [email protected]
EPSS history
Timeline
  • 13 OCT 20:42Z
    Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0…
    cvelistv5