Password Enumeration Vulnerability in Liferay Portal and DXP
CVE-2025-62257
6.3MEDIUM
What is CVE-2025-62257?
A password enumeration vulnerability exists in Liferay Portal versions from 7.4.0 to 7.4.3.119, as well as in Liferay DXP versions 2024.Q1.1 to 2024.Q1.5, which allows remote attackers to conduct brute force attacks and determine valid user passwords, even if account lockout mechanisms are activated. This flaw exposes user accounts to undue risk, highlighting the necessity for heightened security measures and vigilance.
Affected Version(s)
DXP 7.4.13 <= 7.4.13-u92
DXP 2023.Q3.1 <= 2023.Q3.10
DXP 2023.Q4.0 <= 2023.Q4.10