Liferay Portal CVE-2025-62262

Exploitation requires (1) the LDAP import feature of Liferay Portal/DXP to be configured and used, which causes user email addresses to be written into server log files, and (2) a local user with sufficient privileges (PR:H) to read those log files on the host. There is no network vector and no exploitation against default/unconfigured installs: the attacker must already have local, privileged access to the system and to its logs. Limiting factors are significant - local-only access, high required privileges, dependence on the LDAP import feature actually being in use, and an impact limited to disclosure of email addresses (PII) rather than credentials or system control.

This is a low-priority, low-real-risk issue despite its MEDIUM rating. All signals align toward low concern: the CVSS 4.0 vector (AV:L/AC:L/PR:H/UI:N, VC:L only) describes a local attacker who already holds HIGH privileges and gains only limited confidentiality impact - the exposure of user email addresses written to server log files. EPSS is 0.14% (3rd percentile), consistent with the local-only, privilege-gated, low-impact nature of the flaw. There is no CISA KEV listing and no public exploit identified, so exploitation status is 'no public exploit identified at time of analysis.' The signals are internally consistent - no contradictions between the vector (local, authenticated, low impact) and the description (local users viewing emails in logs). The only disclosed impact is PII (email addresses), not credentials or system compromise, so this is an information-disclosure hygiene issue rather than an urgent threat. Note the single NVD reference URL points to CVE-2025-62263 rather than this CVE (62262); the vendor advisory for this exact CVE was not independently confirmed from the provided data.

A low-privileged-but-locally-present actor - such as a server operator, support technician, or someone with read access to Liferay's application log files - reviews logs generated by the LDAP import feature and harvests user email addresses that were inadvertently recorded there. No public proof-of-concept exists; exploitation simply requires reading log files on a host where LDAP import has run, and the local, high-privilege attack vector sharply limits who can do this.