Password Enumeration Vulnerability in Liferay Portal and DXP
CVE-2025-62257

6.3MEDIUM

Key Information:

Vendor

Liferay
Status
Portal
Dxp
Vendor
CVE Published:
29 October 2025

What is CVE-2025-62257?

A password enumeration vulnerability exists in Liferay Portal versions from 7.4.0 to 7.4.3.119, as well as in Liferay DXP versions 2024.Q1.1 to 2024.Q1.5, which allows remote attackers to conduct brute force attacks and determine valid user passwords, even if account lockout mechanisms are activated. This flaw exposes user accounts to undue risk, highlighting the necessity for heightened security measures and vigilance.

Affected Version(s)

DXP 7.4.13 <= 7.4.13-u92

DXP 2023.Q3.1 <= 2023.Q3.10

DXP 2023.Q4.0 <= 2023.Q4.10

References

https://liferay.dev/portal/security/known-vulnerabilities...

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.