GitHub Advisoryadvisory · Maven

GHSA-3j6h-5v68-hvqg Liferay Portal CAPTCHA Bypass for Gogo Shell

MEDIUM Published 2025-08-05 Modified 2025-12-16 Official page ↗
Aliases
CVE-2025-4604
Ecosystem
Maven
Packages
com.liferay:com.liferay.captcha.impl
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N
Weaknesses
CWE-79
Reviewed
2025-08-05

Affected packages

• Maven com.liferay:com.liferay.captcha.impl: < 4.0.17 → fixed in 4.0.17

Description

The vulnerable code can bypass the Captcha check in Liferay Portal 7.4.3.80 through 7.4.3.132, and Liferay DXP 2024.Q1.1 through 2024.Q1.19, 2024.Q2.0 through 2024.Q2.13, 2024.Q3.0 through 2024.Q3.13, 2024.Q4.0 through 2024.Q4.7, 2025.Q1.0 through 2025.Q1.15 and 7.4 update 80 through update 92 and then attackers can run scripts in the Gogo shell.

Related

Alias · CVE (1)

  • CVE-2025-4604 The vulnerable code can bypass the Captcha check in Liferay Portal 7.4.3.80 through 7.4.3.132, and Liferay DXP 2024.Q1.1 through… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References