CVE-2025-62253 MEDIUM

CVE-2025-62253

Vendor Liferay

Product Portal

Weakness CWE-601 · Open redirect

Published October 27, 2025

Last update October 27, 2025

View on NVD All CVEs

CVSS base score

6.9/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Open redirect vulnerability in page administration in Liferay Portal 7.4.0 through 7.4.3.97, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to redirect users to arbitrary external URLs via the _com_liferay_layout_admin_web_portlet_GroupPagesPortlet_redirect parameter.

Key dates

02Disclosure timeline

October 27, 2025 CVE published

October 27, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-62253 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/601.html

Identifiers

CVE CVE-2025-62253

CWE CWE-601

CVSS 6.9 / MEDIUM

Affected versions

Vendor Liferay

Product Portal

Affected ≥ 7.4.0 and ≤ 7.4.3.97

Vendor Liferay

Product DXP

Affected ≥ 7.3.10 and ≤ 7.3.10-u35

Vendor Liferay

Product DXP

Affected ≥ 7.4.13 and ≤ 7.4.13-u92

Vendor Liferay

Product DXP

Affected ≥ 2023.Q3.1 and ≤ 2023.Q3.4