CVE-2025-62251: Medium severity Liferay portal vulnerability
Liferay Portal 7.3.0 through 7.4.3.119, and Liferay DXP 2023.Q3.1 through 2023.Q3.8, 2023.Q4.0 through 2023.Q4.5, 7.4 GA through update 92 and 7.3 GA though update 36 shows content to users who do not have permission to view it via the Menu Display Widget. This security flaw could result in sensitive information being exposed to unauthorized users.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-62251?
CVE-2025-62251 is classified as a high severity vulnerability due to its potential exposure of sensitive content to unauthorized users.
How do I fix CVE-2025-62251?
To remediate CVE-2025-62251, update Liferay Portal to version 7.4.3.120 or later and Liferay DXP to version 2023.Q4.6 or later.
Which software versions are affected by CVE-2025-62251?
CVE-2025-62251 affects Liferay Portal versions 7.3.0 through 7.4.3.119 and Liferay DXP versions 2023.Q3.1 through 2023.Q3.8 and 2023.Q4.0 through 2023.Q4.5.
What risks are associated with CVE-2025-62251?
The risks associated with CVE-2025-62251 include unauthorized access to sensitive content which could lead to data leakage and compliance violations.
Is there a workaround for CVE-2025-62251?
There is currently no known effective workaround for CVE-2025-62251 other than applying the recommended updates to the affected Liferay software.