CVE-2025-62247: Medium severity Liferay portal vulnerability
Missing Authorization in Collection Provider component in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19 allows instance users to read and select unauthorized Blueprints through the Collection Providers across instances.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-62247?
CVE-2025-62247 is classified as a high-severity vulnerability due to the missing authorization in the Collection Provider component.
How do I fix CVE-2025-62247?
To fix CVE-2025-62247, update Liferay Portal to version 7.4.3.132 or later, and Liferay DXP to the respective patched versions listed in the advisory.
Which versions are affected by CVE-2025-62247?
CVE-2025-62247 affects Liferay Portal versions 7.4.0 through 7.4.3.132 and Liferay DXP versions 2024.Q1.1 through 2025.Q2.9.
What components are impacted by CVE-2025-62247?
The vulnerability CVE-2025-62247 impacts the Collection Provider component in Liferay Portal and Liferay DXP.
What risks are associated with CVE-2025-62247?
The risks associated with CVE-2025-62247 include unauthorized access to sensitive data and potential exploitation by attackers.