Open Redirect Vulnerability in Liferay Portal and Liferay DXP
CVE-2025-62253

6.9MEDIUM

Key Information:

Vendor

Liferay
Status
Portal
Dxp
Vendor
CVE Published:
27 October 2025

What is CVE-2025-62253?

This vulnerability in Liferay Portal and Liferay DXP allows remote attackers to exploit the _com_liferay_layout_admin_web_portlet_GroupPagesPortlet_redirect parameter, enabling them to redirect users to malicious external URLs. This can lead to phishing attacks or other security risks by manipulating user redirection without their knowledge. Affected versions include Liferay Portal 7.4.0 to 7.4.3.97 and several versions of Liferay DXP, along with older unsupported releases.

Affected Version(s)

DXP 7.3.10 <= 7.3.10-u35

DXP 7.4.13 <= 7.4.13-u92

DXP 2023.Q3.1 <= 2023.Q3.4

References

https://liferay.dev/portal/security/known-vulnerabilities...

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Abderrahmane BOUNHIDJA
JSON
.