Liferay Portal CVE-2025-62256

Exploitation requires reaching the OpenAPI endpoint of a Liferay Portal (7.4.0-7.4.3.109) or Liferay DXP (2023.Q4.0-Q4.5, 2023.Q3.1-Q3.7, 7.4 GA-update 92, 7.3 GA-update 35, and older) instance via a crafted URL. The description explicitly scopes this to 'certain circumstances,' meaning the improper access restriction is triggered only in specific (unspecified) deployment or configuration states rather than universally - defenders should confirm the exact condition with Liferay before assuming all default installs are exposed. Limiting factors: the disclosure is confined to the OpenAPI YAML specification (an API description document), yielding reconnaissance value rather than direct access to sensitive data, write capability, or code execution; impact is bounded to confidentiality only.

The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N) scores 6.9 (Medium) and describes a remotely reachable, low-complexity, unauthenticated flaw with no user interaction - attractive signals for opportunistic scanning. However, the only impact is confidentiality-low (VC:L): the flaw exposes the OpenAPI YAML specification, not application data, credentials, or code execution; there is no integrity or availability impact. EPSS reinforces the modest real-world risk at 0.40% (33rd percentile), indicating low predicted exploitation likelihood. The CVE is NOT in CISA KEV and no public exploit code was identified in the provided data, so there is no evidence of active exploitation - no SSVC decision data was provided to weigh automatability or technical impact independently. Net assessment: this is a genuine but low-priority information-disclosure/reconnaissance issue rather than a high-impact breach vector; the 6.9 score is driven by easy reachability, not by severe consequence. Note the description's qualifier 'in certain circumstances' is not fully specified, so the unqualified PR:N/AC:L profile may overstate exploitability in hardened or non-default deployments - verify the exact triggering configuration with the Liferay advisory. The 'Authentication Bypass' tag is also slightly imprecise: CWE-862 (Missing Authorization) frames this as a broken-access-control/authorization failure, not an authentication bypass.

A remote, unauthenticated attacker sends a crafted URL to a vulnerable Liferay Portal or DXP instance and retrieves the OpenAPI YAML specification that should have been access-restricted. The leaked spec reveals API endpoints, parameters, and structure, giving the attacker a reconnaissance map to probe for further weaknesses. No public exploit code was identified at time of analysis, and the low CVSS attack complexity (AC:L) means no special timing or conditions are needed once the triggering circumstance is present.