Liferay Portal CVE-2025-62257

The attacker must target a valid, existing user account (so username knowledge or enumeration is a practical prerequisite) and must be able to reach the Liferay authentication endpoint over the network. The core enabling condition is the defect itself: the account-lockout control, even when enabled, fails to stop sustained guessing, so repeated authentication attempts are not throttled. Exploitation is LIMITED by its brute-force nature - success is probabilistic and depends heavily on the target password's strength and length, and strong/unique passwords or compensating controls (WAF rate-limiting, CAPTCHA, MFA, IP throttling) substantially reduce real-world feasibility. This maps to AT:P: success is not guaranteed per request and depends on conditions outside the attacker's direct control.

This is a medium-severity authentication weakness (CWE-307, improper restriction of excessive authentication attempts) that should be treated as a defense-in-depth priority rather than a critical emergency. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N) scores 6.3 and is internally consistent with the description: it is network-reachable and unauthenticated (PR:N), but carries AT:P (attack requirements present) and only VC:L, correctly reflecting that success is probabilistic and yields limited confidentiality impact rather than guaranteed full compromise. No EPSS score, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The AT:P / brute-force framing is the key risk moderator: exploitation is not a single deterministic request but a guessing campaign whose success depends on the target account's password strength, which is why this is a realistic but not drop-everything issue. EPSS is simply absent (not low) - absence of exploitation-probability data is a gap, not a signal of safety. Bottom line: a genuine control bypass worth patching on a normal enterprise cycle, but not a high-CVSS-masquerading-as-critical case and not comparable to an RCE.

A remote, unauthenticated attacker targets a known or enumerated Liferay username on the portal login endpoint and submits a high volume of password guesses. Because the account-lockout protection can be bypassed, the lockout fails to throttle the attempts, allowing the attacker to continue guessing until a weak or common password is recovered. No public exploit code was identified in the provided data, so this would currently require attacker-developed brute-force tooling.