GitHub Advisoryadvisory · Maven

GHSA-g4wg-mpfg-x2q6 Liferay Portal Login Bypass Vulnerability

LOW Published 2025-08-18 Modified 2025-08-18 Official page ↗
Aliases
CVE-2025-3639
Ecosystem
Maven
Packages
com.liferay.portal:release.portal.bom
Severity
Low
CVSS vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weaknesses
CWE-288
Reviewed
2025-08-18

Affected packages

• Maven com.liferay.portal:release.portal.bom: >= 7.3.0-ga1, <= 7.4.3.132-ga132 (no fix yet)

Description

Liferay Portal 7.3.0 through 7.4.3.132, and Liferay DXP 2025.Q1 through 2025.Q1.6, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, 7.4 GA through update 92 and 7.3 GA through update 36 allows unauthenticated users with valid credentials to bypass the login process by changing the POST method to GET, once the site has MFA enabled.

Related

Alias · CVE (1)

  • CVE-2025-3639 Liferay Portal 7.3.0 through 7.4.3.132, and Liferay DXP 2025.Q1 through 2025.Q1.6, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through… vulnerability

Weakness · CWE (1)

  • CWE-288 Authentication Bypass Using an Alternate Path or Channel weakness

References