Liferay Portal CVE-2025-62247

Requires an authenticated instance user account (PR:L) on an affected Liferay Portal (7.4.0-7.4.3.132) or Liferay DXP build, plus active user interaction (UI:A) with the Collection Provider component, and the vendor-indicated attack requirement (AT:P) must be met. Exploitation is only meaningful in multi-instance (multi-tenant) deployments where cross-instance Blueprint isolation is expected - in a single-instance deployment there are no other instances' Blueprints to expose. Limiting factors: valid credentials are mandatory, user interaction is required, impact is confined to reading/selecting Blueprint objects (no credential or user-data exposure), and the practical value depends on a multi-tenant configuration.

This is a genuinely low-priority issue despite being a cross-instance authorization flaw. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:A) and base score of 2.0 align consistently with the description: exploitation requires an authenticated instance user (PR:L), active user interaction (UI:A), and a specific attack condition (AT:P), and yields only low impact across confidentiality, integrity, and availability (VC:L/VI:L/VA:L). All signals point the same direction - EPSS is low at 0.27% (18th percentile), there is no CISA KEV listing, and no public exploit was identified in the provided data. No SSVC decision data was supplied. The one notable nuance is the cross-instance scope: a multi-tenant Liferay deployment where instances are expected to be strongly isolated may weight this higher than the raw score implies, because any cross-tenant data leakage can breach a trust boundary. However, the data disclosed is limited to Blueprints (Collection Provider configuration objects), not credentials or user data, so real-world risk remains low. There are no conflicting signals here - this is a low-severity, authenticated, low-impact information-exposure issue, not a high-CVSS-but-low-risk case nor an underrated one.

An authenticated low-privilege user on one tenant instance of a multi-tenant Liferay deployment interacts with the Collection Provider feature and, due to missing authorization checks, is able to enumerate, read, and select Blueprints belonging to other instances they should not have access to. No public exploit code was identified, and the attack requires both valid credentials and active user interaction, limiting its practical reach.