CVE-2025-62275
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-11-01

Last updated on: 2025-11-10

Assigner: Liferay Inc.

Description
Blogs in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions does not check permission of images in a blog entry, which allows remote attackers to view the images in a blog entry via crafted URL.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-11-01
Last Modified
2025-11-10
Generated
2026-06-16
AI Q&A
2025-11-01
EPSS Evaluated
2026-06-14
NVD
CVE-2025-62275
Affected Vendors & Products
Showing 23 associated CPEs
Vendor Product Version / Range
liferay digital_experience_platform 7.4
liferay digital_experience_platform 2023.q3.1
liferay digital_experience_platform 2023.q3.2
liferay digital_experience_platform 2023.q3.3
liferay digital_experience_platform 2023.q3.4
liferay digital_experience_platform 2023.q3.5
liferay digital_experience_platform 2023.q3.6
liferay digital_experience_platform 2023.q3.7
liferay digital_experience_platform 2023.q3.8
liferay digital_experience_platform 2023.q3.9
liferay digital_experience_platform 2023.q3.10
liferay digital_experience_platform 2023.q4.0
liferay digital_experience_platform 2023.q4.1
liferay digital_experience_platform 2023.q4.2
liferay digital_experience_platform 2023.q4.3
liferay digital_experience_platform 2023.q4.4
liferay digital_experience_platform 2023.q4.5
liferay digital_experience_platform 2023.q4.6
liferay digital_experience_platform 2023.q4.7
liferay digital_experience_platform 2023.q4.8
liferay digital_experience_platform 2023.q4.9
liferay digital_experience_platform 2023.q4.10
liferay liferay_portal From 7.4.0 (inc) to 7.4.3.112 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2025-62275 is a security vulnerability in the Blogs component of Liferay Portal and Liferay DXP. The system fails to check permissions for images embedded in blog entries, allowing remote attackers to view these images without any authentication by using a specially crafted URL. [1]

Impact Analysis

This vulnerability allows unauthorized remote attackers to access and view images embedded in blog entries without any privileges or user interaction. This could lead to unintended disclosure of potentially sensitive or private images hosted within the blog entries. [1]

Detection Guidance

This vulnerability can be detected by checking if images embedded in blog entries are accessible without proper permission checks. You can attempt to access image URLs from blog entries without authentication to see if they are viewable. For example, using curl or wget commands to request image URLs from the Liferay Portal or DXP Blogs component and observing if access is granted without login. Specific commands might include: curl -I http://<liferay-host>/blogs/image/<image-id> or wget --spider http://<liferay-host>/blogs/image/<image-id>. If these commands return HTTP 200 OK without authentication, the system is vulnerable. [1]

Mitigation Strategies

The immediate mitigation step is to upgrade affected Liferay Portal and Liferay DXP installations to fixed versions: Liferay Portal version 7.4.3.112 or later, and Liferay DXP 2024.Q1.1 or later. Until the upgrade can be applied, restrict access to the Blogs images URLs by implementing network-level controls such as firewall rules or web application firewall (WAF) rules to block unauthorized access to blog images. Additionally, review and tighten permissions on blog content and images where possible. [1]

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-62275. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart