Liferay Portal
CVE-2025-62244
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to Liferay Portal/DXP
-
ExploitTamper ctCollectionId parameter in PublicationsPortlet request
-
ImpactView unauthorized publication edit page
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | The attacker must hold a valid authenticated Liferay Portal/DXP account (PR:L) with access to the change-tracking Publications feature, and must supply a crafted value in the _com_liferay_change_tracking_web_portlet_PublicationsPortlet_ctCollectionId parameter to reference another collection's publication. Exploitation is limited by: required authentication (not open to anonymous users), required user interaction (UI:A), and a read-only outcome - the attacker only views the publication edit page (VC:L) with no ability to modify data or affect availability. Affected deployments are Liferay Portal 7.3.1-7.4.3.111 and the enumerated DXP 2023.Q3/Q4, 7.4, and 7.3 update ranges; patched releases are not vulnerable. |
| Impact | This is a genuinely low-priority issue despite being network-reachable. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:A/VC:L) yields only 4.8 (Medium): exploitation requires an authenticated account (PR:L) and some user interaction (UI:A), and the impact is confined to low confidentiality (VC:L) with no integrity or availability impact (VI:N/VA:N) - it is read-only disclosure of a publication's edit page, consistent with the CWE-639 IDOR classification. The EPSS score of 0.29% (20th percentile) is low and reinforces the low-urgency picture. There is no CISA KEV listing and no public exploit code identified, so this is neither actively exploited nor weaponized. No SSVC decision data was provided. All signals are consistent and point in the same direction: a legitimate but low-severity authorization flaw, not a high-CVSS-but-overstated issue and not an urgent patch-now item. Note one minor data inconsistency: the input tag 'Authentication Bypass' mischaracterizes this flaw - it is a post-authentication authorization/IDOR issue (attacker is already authenticated per PR:L), not a bypass of authentication. |
| Exploit ScenarioDerived | An authenticated low-privilege Liferay user manipulates the _com_liferay_change_tracking_web_portlet_PublicationsPortlet_ctCollectionId parameter to reference a publication they are not authorized to see, and is served that publication's edit page, disclosing its contents. No public exploit code is known, and the network vector is tempered by the requirement for valid credentials and user interaction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 18, 2026
An insecure direct object reference (IDOR) in the Publications portlet of Liferay Portal and Liferay DXP lets a signed-in user view the edit page of a change-tracking publication they are not authorized to see by tampering with the _com_liferay_change_tracking_web_portlet_PublicationsPortlet_ctCollectionId parameter. Affected releases are Liferay Portal 7.3.1 through 7.4.3.111 and Liferay DXP 7.3 GA through update 36, 7.4 GA through update 92, 2023.Q3.1 through 2023.Q3.8, and 2023.Q4.0 through 2023.Q4.5. Exploitation requires a valid authenticated account with access to the Publications feature and some user interaction, and the outcome is read-only disclosure of a publication's edit-page content - no data modification or availability impact - which is why EPSS is low (0.29%, 20th percentile) and no public exploit has been identified at time of analysis; no vendor-released patch version is specified in the available data, so the linked Liferay advisory should be treated as the authoritative source for fixed builds.
RemediationAI
Apply the vendor update for your Liferay line as documented in Liferay's known-vulnerabilities advisory (https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62244); the published affected ranges terminate at Portal 7.4.3.111 and DXP 7.3 update 36, 7.4 update 92, 2023.Q3.8, and 2023.Q4.5, so any deployment at or below those bounds should move to the next available release and then verify the specific fixed build against the advisory, since an exact patch version is not stated in the available data. If upgrading cannot be done immediately, the effective compensating control is least privilege on the change-tracking feature: remove the Publications portlet permission and the Change Tracking administration role from all non-administrative roles so ordinary users cannot reach the portlet at all - the trade-off is that content authors lose the staged-publication review workflow and must publish directly or through an administrator. As a narrower alternative, restrict the Publications portlet to a small named group of editors and review that group's membership, accepting that anyone still in the group retains the ability to read other collections' edit pages. Because the request parameter ctCollectionId is attacker-controlled, proxy or WAF rules that reject Publications edit-page requests carrying collection IDs outside the caller's known set can help, but such rules are brittle against ID encoding variations and should only be a stopgap. Finally, monitor portal access logs for sequential or out-of-range ctCollectionId values on the Publications portlet as a detection signal for attempted enumeration.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in maven
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is CWE-639 (Authorization Bypass Through User-Controlled Key), the classic IDOR pattern in which an application accepts a client-supplied object identifier and resolves it to a record without re-verifying that the requesting principal is entitled to that record. Here the object key is ctCollectionId, the identifier of a change-tracking collection (a "publication") managed by Liferay's Change Tracking / Publications framework, which stages content changes for review before they are published to the live site. The PublicationsPortlet in the change-tracking web module renders the publication edit page keyed directly off that request parameter, and the missing (or insufficient) ownership/permission check means any authenticated user who can reach the portlet can enumerate or guess another collection's ID and be served that publication's edit view. Scope is unchanged and confidentiality impact is low - the exposure is the publication editing UI and its metadata, not a write primitive - and the CVSS 4.0 vector supplied by the vendor (4.8, PR:L/UI:A/VC:L) aligns with the independently assessed CVSS 3.1 vector AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N. Because the vulnerable component is a standard Liferay web module rather than a custom extension, the issue is present in the default distribution of the listed Portal and DXP versions; the generic CPE entries for liferay:digital_experience_platform and liferay:liferay_portal reflect that version-range matching, not a single build.
Know when Liferay Portal gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Network-reachable but requires an authenticated account (PR:L) and user interaction (UI:R); impact is read-only disclosure of one page, so C:L and I/A:N.
Primary rating from Vendor (liferay).
CVSS VectorVendor: liferay
DescriptionCVE.org
Insecure direct object reference (IDOR) vulnerability in Publications in Liferay Portal 7.3.1 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92, and 7.3 GA through update 36 allows remote authenticated attackers to view the edit page of a publication via the _com_liferay_change_tracking_web_portlet_PublicationsPortlet_ctCollectionId parameter.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Affected Products (CPE)CVE.org
More in Liferay Portal
View allRemote code execution in Liferay Portal Community Edition (CE) versions prior to 7.2.1 CE GA2 allows unauthenticated rem
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024
Liferay Portal CE 6.2.5 allows remote command execution because of deserialization of a JSON payload. Rated critical sev
In Liferay Portal before 7.3.2 and Liferay DXP 7.0 before fix pack 92, 7.1 before fix pack 18, and 7.2 before fix pack 6
Liferay 6.2.x and before has an FCKeditor configuration that allows an attacker to upload or transfer files of dangerous
Cross-site scripting (XSS) vulnerability in users.jsp in the Profile Search functionality in Liferay before 7.0.0 CE RC1
An issue was discovered in Liferay Portal CE 7.1.2 GA3. Rated high severity (CVSS 7.2), this vulnerability is remotely e
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.133, and Liferay DXP 2025
A Cross-site scripting (XSS) vulnerability in the Portal Search module in Liferay Portal 7.1.0 through 7.4.2, and Lifera
In Liferay Portal 6.1.0, the tags section has XSS via a Public Render Parameter (p_r_p) value, as demonstrated by p_r_p_
HtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.18, and older unsupported versions, and Liferay DXP 7.4 be
A SQL injection vulnerability in the Fragment module in Liferay Portal 7.3.3 through 7.4.3.16, and Liferay DXP 7.3 befor
GitHub PoC
Exploit-DB