BaseFortify

Publication date: 2025-10-27

Last updated on: 2025-12-12

Assigner: Liferay Inc.

Description

Open redirect vulnerability in page administration in Liferay Portal 7.4.0 through 7.4.3.97, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to redirect users to arbitrary external URLs via the _com_liferay_layout_admin_web_portlet_GroupPagesPortlet_redirect parameter.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-27

Last Modified

2025-12-12

Generated

2026-07-06

AI Q&A

2025-10-27

EPSS Evaluated

2026-07-05

NVD

CVE-2025-62253

Affected Vendors & Products

Vendor	Product	Version / Range
liferay	digital_experience_platform	to 7.3 (exc)
liferay	digital_experience_platform	7.3
liferay	digital_experience_platform	7.3
liferay	digital_experience_platform	7.3
liferay	digital_experience_platform	7.3
liferay	digital_experience_platform	7.3
liferay	digital_experience_platform	7.3
liferay	digital_experience_platform	7.3
liferay	digital_experience_platform	7.3
liferay	digital_experience_platform	7.3
liferay	digital_experience_platform	7.3
liferay	digital_experience_platform	7.3
liferay	digital_experience_platform	7.3
liferay	digital_experience_platform	7.3
liferay	digital_experience_platform	7.3
liferay	digital_experience_platform	7.3
liferay	digital_experience_platform	7.3
liferay	digital_experience_platform	7.3
liferay	digital_experience_platform	7.3
liferay	digital_experience_platform	7.3
liferay	digital_experience_platform	7.3
liferay	digital_experience_platform	7.3
liferay	digital_experience_platform	7.3
liferay	digital_experience_platform	7.3
liferay	digital_experience_platform	7.3
liferay	digital_experience_platform	7.3
liferay	digital_experience_platform	7.3
liferay	digital_experience_platform	7.3
liferay	digital_experience_platform	7.3
liferay	digital_experience_platform	7.3
liferay	digital_experience_platform	7.3
liferay	digital_experience_platform	7.3
liferay	digital_experience_platform	7.3
liferay	digital_experience_platform	7.3
liferay	digital_experience_platform	7.3
liferay	digital_experience_platform	7.3
liferay	digital_experience_platform	7.3
liferay	digital_experience_platform	7.3
liferay	digital_experience_platform	7.3
liferay	digital_experience_platform	7.3
liferay	digital_experience_platform	7.3
liferay	digital_experience_platform	7.4
liferay	digital_experience_platform	2023.q3.1
liferay	digital_experience_platform	2023.q3.2
liferay	digital_experience_platform	2023.q3.3
liferay	digital_experience_platform	2023.q3.4
liferay	liferay_portal	to 7.3.7 (inc)
liferay	liferay_portal	From 7.4.0 (inc) to 7.4.3.98 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-601	The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Attack-Flow Graph

Executive Summary

This vulnerability is an open redirect issue in the page administration component of Liferay Portal and Liferay DXP versions specified. It allows remote attackers to redirect users to arbitrary external URLs by manipulating the _com_liferay_layout_admin_web_portlet_GroupPagesPortlet_redirect parameter.

Impact Analysis

The vulnerability can be exploited by attackers to redirect users to malicious external websites, potentially leading to phishing attacks, malware distribution, or other harmful activities that compromise user security and trust.

Hi! I’m here to help you understand CVE-2025-62253. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70