Liferay Portal CVE-2025-62250

Exploitation requires that the target run Liferay Portal/DXP in clustered mode and that the attacker have network access to the cluster messaging channel between nodes; the flaw is that cluster messages are accepted without proper origin/authentication validation and treated as trusted data. No portal user account, credentials, or user interaction is required (PR:N/UI:N). The principal limiting factors are deployment-specific: clustering must be enabled and the cluster communication transport must be reachable by the attacker - standalone single-node installations and deployments that isolate cluster traffic on a dedicated, trusted network segment are not realistically exposed. Only the listed Liferay Portal 7.4.x (through 7.4.3.132) and DXP branches (2023.Q4.0, 2023.Q3.1-2023.Q3.4, 7.4 GA-update 92, 7.3 GA-update 35, and older unsupported versions) are affected.

This is a moderate-priority issue whose signals align consistently toward limited real-world risk despite a network-facing, unauthenticated vector. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes remote exploitation with no privileges or user interaction, but the impact metrics are deliberately modest - VC:L/VI:L and VA:N - yielding a base score of only 6.9 (Medium). The flaw (CWE-346, origin/authentication validation on cluster messages) lets an attacker inject data the portal treats as trusted, but it does not by itself grant code execution, full data compromise, or denial of service per the vendor scoring. EPSS reinforces low urgency: 0.17% probability at the 6th percentile, indicating very low likelihood of near-term mass exploitation. The CVE is NOT in CISA KEV and no public exploit code was identified, so this is 'no public exploit identified at time of analysis.' Importantly, the realistic attack surface is narrower than AV:N suggests: the vulnerability lives in Liferay's inter-node cluster messaging, which is only present and reachable when the portal is deployed in clustered mode with cluster communication exposed to an attacker - a limiting factor the CVSS vector does not capture. Net assessment: a legitimate issue to patch on a normal cycle, not an emergency; treat as higher priority only for internet-adjacent or flat-network clustered DXP deployments where cluster ports are reachable by untrusted hosts.

An attacker with network reachability to a Liferay cluster node's messaging channel crafts a malicious cluster message that the portal accepts and processes as trusted inter-node data, allowing limited unauthorized disclosure or manipulation of portal state. Because exploitation requires AV:N/AC:L/PR:N/UI:N, no credentials or user interaction are needed, but it is only viable against deployments running in clustered mode. No public proof-of-concept exploit was identified at the time of analysis.