CVE-2025-62262

CWE-532 — Log File Information Exposure4 documents4 sources

Severity

4.6MEDIUM

EPSS

0.0%

top 97.05%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Liferay Liferay Portal Liferay DXP Liferay Portal +1 more

Timeline

PublishedOct 27

Description

Information exposure through log file vulnerability in LDAP import feature in Liferay Portal 7.4.0 through 7.4.3.97, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows local users to view user email address in the log files.

CVSS vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Affected Packages5 packages

▶Mavencom.liferay:com.liferay.portal.security.ldap.impl4.0.2 — 4.0.54

▶NVDliferay/liferay_portal7.0.0 — 7.4.3.98

▶CVEListV5liferay/portal7.4.0 — 7.4.3.97

▶CVEListV5liferay/dxp7.3.10 — 7.3.10-u35+2

▶NVDliferay/digital_experience_platform6 versions+5

🔴Vulnerability Details

OSV

Liferay Portal Vulnerable to Information Exposure Through a Log File Vulnerability in LDAP Import Feature↗2025-10-27

▶

GHSA

Liferay Portal Vulnerable to Information Exposure Through a Log File Vulnerability in LDAP Import Feature↗2025-10-27

▶

CVEList

CVE-2025-62262: Information exposure through log file vulnerability in LDAP import feature in Liferay Portal 7↗2025-10-27

▶