GitHub Advisoryadvisory · Maven

GHSA-xf7m-v66q-76w8 Liferay Portal and DXP do not check permissions of images in a blog entry

MEDIUM Published 2025-11-01 Modified 2025-11-15 Official page ↗
Aliases
CVE-2025-62275
Ecosystem
Maven
Packages
com.liferay:com.liferay.blogs.item.selector.web
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-863
Reviewed
2025-11-03

Affected packages

• Maven com.liferay:com.liferay.blogs.item.selector.web: < 6.0.19 → fixed in 6.0.19

Description

Blogs in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions does not check permission of images in a blog entry, which allows remote attackers to view the images in a blog entry via crafted URL.

Related

Alias · CVE (1)

  • CVE-2025-62275 Blogs in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1… vulnerability

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References