Liferay Portal CVE-2025-62266

Exploitation requires that Liferay's redirect URL security be configured to validate by IP address rather than by domain - this is the default state the advisory says is vulnerable, and the explicit fix is to switch redirect URL security from IP to domain. The attacker must control a domain/DNS to perform the rebinding, and the victim must actively click and follow the redirect (UI:A), which limits exploitation to social-engineering/phishing flows. Impact is confined to redirecting the user's browser to an arbitrary external URL (no code execution, no data read on the server); environments already configured with domain-based redirect validation are not affected.

This is a medium-severity open redirect (CWE-601) exploitable via DNS rebinding, and all available signals point to it being a genuine but low-priority issue rather than an urgent threat. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A, score 5.1) indicates a network-reachable, unauthenticated flaw, but one that is gated by active user interaction (UI:A) and yields only low confidentiality and integrity impact (VC:L/VI:L) with no availability impact and no scope change to subsequent systems. There is no CISA KEV listing and no EPSS score provided, and no public exploit was referenced, so there is no evidence of active or widespread exploitation - consistent with the limited, phishing-style impact typical of open redirects. I would note a tension in the CVSS complexity rating: DNS rebinding realistically requires the attacker to control a domain, manipulate DNS TTL/resolution, and defeat same-origin/host-check timing, which argues for higher attack complexity than the AC:L in the input vector suggests. Net: a legitimate finding worth patching in routine cycles, but not a drop-everything emergency absent confirmed exploitation.

An attacker registers a domain under their control and lures a Liferay user to a crafted link; using DNS rebinding the host that initially passes Liferay's IP-based redirect validation is re-resolved to an attacker-controlled external address, so the portal redirects the victim to an arbitrary malicious URL (e.g. a phishing or malware page). Success depends on the victim clicking the link and following the redirect (UI:A), and no public exploit code was identified in the provided data.