Liferay Portal CVE-2025-62251

Exploitation requires that a Menu Display Widget is actually configured and placed on an accessible portal page, and that menu-linked content with view restrictions exists behind it - without a deployed Menu Display Widget fronting restricted content, the flaw is not reachable. The vendor CVSS vector indicates high privileges (PR:H) and passive user interaction (UI:P) are involved, meaning the attacker must be an authenticated portal actor and the disclosure occurs through normal page rendering rather than a crafted anonymous request. Limiting factors: the bug only leaks data the widget surfaces (low confidentiality impact), affects specific Liferay Portal 7.3.0-7.4.3.119 and DXP 2023.Q3/Q4 and 7.3/7.4 GA-update ranges, and does not permit modification or denial of service.

This is a low-to-moderate priority information-disclosure flaw, not an urgent one. The vendor CVSS 4.0 base score of 4.8 (MEDIUM) reflects limited scope: only low confidentiality/integrity impact (VC:L/VI:L, VA:N) and significant preconditions. EPSS reinforces low urgency at 0.27% (18th percentile), and there is no CISA KEV listing and no public exploit identified, so there is no evidence of active exploitation or weaponization. The signals are internally consistent (low CVSS + low EPSS + no KEV/POC) rather than conflicting. One notable tension exists within the CVSS vector itself: the vendor assigned PR:H (high privileges required) and UI:P (passive user interaction), yet the description frames the issue as content leaking to 'users who do not have permission to view it,' which intuitively suggests a lower-privileged or even anonymous viewer rather than a high-privilege attacker - this PR:H choice appears to model the privilege needed to configure/place the Menu Display Widget rather than the privilege of the unauthorized viewer, and should be verified with the vendor advisory. Overall: a real but narrow permission-enforcement bug worth patching in routine cycles, not an emergency.

An authenticated Liferay user navigates to a portal page containing a Menu Display Widget and, through that widget, is shown menu-linked content they are not authorized to view, exposing restricted or sensitive information. No public exploit code is known, and exploitation hinges on the widget being deployed and restricted content existing behind it. The attack is network-reachable but constrained by the privilege and interaction requirements in the CVSS vector.