GitHub Advisoryadvisory · Maven

GHSA-j4f7-gj7q-xg9m Liferay has Incorrect Permission Assignment for Critical Resource

MEDIUM Published 2025-10-14 Modified 2025-10-15 Official page ↗
Aliases
CVE-2025-62251
Ecosystem
Maven
Packages
com.liferay:com.liferay.site.navigation.menu.item.asset.vocabulary
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Weaknesses
CWE-732
Reviewed
2025-10-15

Affected packages

• Maven com.liferay:com.liferay.site.navigation.menu.item.asset.vocabulary: < 1.0.23 → fixed in 1.0.23

Description

Liferay Portal 7.3.0 through 7.4.3.119, and Liferay DXP 2023.Q3.1 through 2023.Q3.8, 2023.Q4.0 through 2023.Q4.5, 7.4 GA through update 92 and 7.3 GA though update 36 shows content to users who do not have permission to view it via the Menu Display Widget. This security flaw could result in sensitive information being exposed to unauthorized users.

Related

Alias · CVE (1)

  • CVE-2025-62251 Liferay Portal 7.3.0 through 7.4.3.119, and Liferay DXP 2023.Q3.1 through 2023.Q3.8, 2023.Q4.0 through 2023.Q4.5, 7.4 GA through update 92… vulnerability

Weakness · CWE (1)

  • CWE-732 Incorrect Permission Assignment for Critical Resource weakness

References