Access Restriction Flaw in Liferay Portal and DXP

CVE-2025-62256

What is CVE-2025-62256?

The vulnerability in Liferay Portal and DXP arises from inadequate restrictions on access to the OpenAPI YAML file. This issue permits remote attackers to exploit specific crafted URLs to access sensitive OpenAPI information without proper authorization. Affected versions span from Liferay Portal 7.4.0 to 7.4.3.109, and various releases of Liferay DXP, posing significant risks for users who have not updated to secure versions.

References