CVE-2025-62252
published 2025-10-13CVE-2025-62252: Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0…
PriorityP423medium4.3CVSS 3.1
AVNACLPRLUINSUCNILAN
EPSS
0.25%
16.2th percentile
Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions allows remote authenticated users in one virtual instance to assign an organization to a user in a different virtual instance via the _com_liferay_users_admin_web_portlet_UsersAdminPortlet_addUserIds parameter.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| liferay | digital_experience_platform | <= 7.4 | — |
| liferay | digital_experience_platform | 2023.Q3.1 – 2023.Q3.10 | — |
| liferay | digital_experience_platform | >= 2023.q4.0 < 2023.q4.6 | 2023.q4.6 |
| liferay | dxp | 2023.Q3.1 – 2023.Q3.10 | — |
| liferay | dxp | 2023.Q4.0 – 2023.Q4.5 | — |
| liferay | dxp | 7.4.13 – 7.4.13-u92 | — |
| liferay | liferay_portal | >= 7.1.0 < 7.4.3.112 | 7.4.3.112 |
| liferay | portal | 7.4.0 – 7.4.3.111 | — |
CVSS provenance
nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
nvdv4.05.3MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Liferay is Vulnerable to Authorization Bypass Through User-Controlled Key
ghsa·2025-10-13
CVE-2025-62252 [MEDIUM] CWE-639 Liferay is Vulnerable to Authorization Bypass Through User-Controlled Key
Liferay is Vulnerable to Authorization Bypass Through User-Controlled Key
Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions allows remote authenticated users in one virtual instance to assign an organization to a user in a different virtual instance via the _com_liferay_users_admin_web_portlet_UsersAdminPortlet_addUserIds parameter.
OSV
Liferay is Vulnerable to Authorization Bypass Through User-Controlled Key
osv·2025-10-13
CVE-2025-62252 [MEDIUM] Liferay is Vulnerable to Authorization Bypass Through User-Controlled Key
Liferay is Vulnerable to Authorization Bypass Through User-Controlled Key
Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions allows remote authenticated users in one virtual instance to assign an organization to a user in a different virtual instance via the _com_liferay_users_admin_web_portlet_UsersAdminPortlet_addUserIds parameter.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-10-13
Published