Information Exposure Vulnerability in Liferay Portal and Liferay DXP

CVE-2025-62262

What is CVE-2025-62262?

The Liferay Portal and Liferay DXP are affected by a security vulnerability that allows local users to access sensitive information, specifically user email addresses, through compromised log files. This issue arises in versions 7.4.0 through 7.4.3.97 of Liferay Portal and multiple versions of Liferay DXP, including 2023.Q3.1 to 2023.Q3.4, as well as several older unsupported versions. Organizations using these products should take immediate action to mitigate this security risk to protect user data.

References