Liferay Portal CVE-2025-62253

Exploitation requires that the Liferay Portal / DXP page-administration function (the layout admin GroupPagesPortlet) be reachable by the attacker, and that a victim be induced to open a crafted URL containing the _com_liferay_layout_admin_web_portlet_GroupPagesPortlet_redirect parameter set to an arbitrary external URL. No authentication is indicated by the vendor vector (PR:N), and it works against affected default versions: Liferay Portal 7.4.0 through 7.4.3.97 and older, and Liferay DXP 2023.Q4.0, 2023.Q3.1-2023.Q3.4, 7.4 GA-update 92, 7.3 GA-update 35 and older. The principal limiting factor is that harm is not self-contained: a victim must actually click the attacker-supplied link and then act on the destination (e.g., enter credentials), so impact depends on social-engineering success rather than direct system compromise.

This is a genuinely moderate, not high, priority. The CVSS 4.0 base score of 6.9 is driven mostly by the fully remote, unauthenticated, low-complexity vector (AV:N/AC:L/AT:N/PR:N/UI:N) rather than by impact - the only impact metric set is VA:L (vulnerable-system availability, Low), with all confidentiality and integrity metrics marked None. That impact modeling is itself questionable: an open redirect (CWE-601) does not degrade availability of the Liferay system; its real harm is redirecting victims to attacker-controlled sites for phishing or credential/token theft, which is an integrity/user-trust impact that typically also requires the victim to click a crafted link (so UI:N from the vendor is debatable). EPSS reinforces the modest risk picture: 0.25% probability at the 15th percentile indicates low expected exploitation volume. The vulnerability is NOT in CISA KEV and no public exploit code is referenced, so there is no evidence of active exploitation. Net: a real, broadly reachable flaw worth patching in exposed portals, but a classic 'useful-in-phishing-chains' open redirect rather than an urgent RCE-class emergency. Conflicting signal to verify: the vendor's VA:L (availability) impact does not match the open-redirect behavior described - treat the impact dimension with caution.

An attacker crafts a legitimate-looking Liferay Portal page-administration URL whose _com_liferay_layout_admin_web_portlet_GroupPagesPortlet_redirect parameter points to an attacker-controlled site, then distributes it via email or messaging. A victim who trusts the organization's real Liferay domain clicks the link, is silently redirected to a phishing clone, and submits credentials. No public exploit code is identified at time of analysis, but exploitation requires only a crafted URL and is trivial to reproduce.