GitHub Advisoryadvisory · Maven

GHSA-6533-fhr2-f38h Liferay Portal and DXP use an incorrect cache-control header

MEDIUM Published 2025-11-01 Modified 2025-11-15 Official page ↗
Aliases
CVE-2025-62276
Ecosystem
Maven
Packages
com.liferay:com.liferay.adaptive.media.web, com.liferay.portal:com.liferay.portal.impl
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-525
Reviewed
2025-11-03

Affected packages

• Maven com.liferay:com.liferay.adaptive.media.web: < 5.0.52 → fixed in 5.0.52 • Maven com.liferay.portal:com.liferay.portal.impl: < 69.1.0 → fixed in 69.1.0

Description

The Document Library and the Adaptive Media modules in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions uses an incorrect cache-control header, which allows local users to obtain access to downloaded files via the browser's cache.

Related

Alias · CVE (1)

  • CVE-2025-62276 The Document Library and the Adaptive Media modules in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay… vulnerability

Weakness · CWE (1)

  • CWE-525 Use of Web Browser Cache Containing Sensitive Information weakness

References