GitHub Advisoryadvisory · Maven

GHSA-cqwv-9xh5-25fg Liferay Portal and DXP are Missing Authorization in Collection Provider

LOW Published 2025-10-22 Modified 2025-10-22 Official page ↗
Aliases
CVE-2025-62247
Ecosystem
Maven
Packages
com.liferay:com.liferay.search.experiences.service
Severity
Low
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L
Weaknesses
CWE-862
Reviewed
2025-10-22

Affected packages

• Maven com.liferay:com.liferay.search.experiences.service: <= 3.0.84 (no fix yet)

Description

Missing Authorization in Collection Provider component in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19 allows instance users to read and select unauthorized Blueprints through the Collection Providers across instances.

Related

Alias · CVE (1)

  • CVE-2025-62247 Missing Authorization in Collection Provider component in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through… vulnerability

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References