fkie_nvd - fkie_cve-2025-62242

FKIE_CVE-2025-62242

Vulnerability from fkie_nvd - Published: 2025-10-13 20:15 - Updated: 2025-11-07 19:11

Severity ?

4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Summary

Insecure Direct Object Reference (IDOR) vulnerability with account addresses in Liferay Portal 7.4.3.4 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92 allows remote authenticated users to from one account to view addresses from a different account via the _com_liferay_account_admin_web_internal_portlet_AccountEntriesAdminPortlet_addressId parameter.

References

	URL	Tags
	security@liferay.com	https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62245	Vendor Advisory

Impacted products

Vendor	Product	Version
liferay	digital_experience_platform	7.4
liferay	digital_experience_platform	2023.q3.1
liferay	digital_experience_platform	2023.q3.2
liferay	digital_experience_platform	2023.q3.3
liferay	digital_experience_platform	2023.q3.4
liferay	digital_experience_platform	2023.q3.5
liferay	digital_experience_platform	2023.q3.6
liferay	digital_experience_platform	2023.q3.7
liferay	digital_experience_platform	2023.q3.8
liferay	digital_experience_platform	2023.q3.9
liferay	digital_experience_platform	2023.q3.10
liferay	digital_experience_platform	2023.q4.1
liferay	digital_experience_platform	2023.q4.2
liferay	digital_experience_platform	2023.q4.3
liferay	digital_experience_platform	2023.q4.4
liferay	digital_experience_platform	2023.q4.5
liferay	liferay_portal	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "8E19E344-92B4-4B46-BD89-25EC7191972C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:liferay:digital_experience_platform:2023.q3.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "1EF6451A-2A5D-4222-A1C6-113AA4B8D4E6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:liferay:digital_experience_platform:2023.q3.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "9D6CE430-3C95-4855-BA44-E2E136D1FEB2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:liferay:digital_experience_platform:2023.q3.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "44FEB149-C792-493D-B055-568FFC96298A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:liferay:digital_experience_platform:2023.q3.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "B050DD73-71B6-46CD-A35B-7ACB53BE6C6A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:liferay:digital_experience_platform:2023.q3.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "62432289-E1DC-4013-85C7-6B77299A910F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:liferay:digital_experience_platform:2023.q3.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "0912EEFE-DC56-43F6-AE0E-A4E2A033F3C5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:liferay:digital_experience_platform:2023.q3.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "9398F679-5F47-4DF2-AA91-4A21126675C6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:liferay:digital_experience_platform:2023.q3.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "8296B54A-976A-404C-AB77-0619E4297A69",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:liferay:digital_experience_platform:2023.q3.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "F778EB15-2AB0-44C1-BD99-9F7F1851E167",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:liferay:digital_experience_platform:2023.q3.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "625E6C10-D0C7-4C5D-99F8-601A7B942392",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:liferay:digital_experience_platform:2023.q4.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "A27A8480-7EE1-4265-9117-D6C234ACAC5F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:liferay:digital_experience_platform:2023.q4.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "94425688-725E-41DC-B2D3-14F2A7163AD6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:liferay:digital_experience_platform:2023.q4.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "623CA096-BDBB-4F59-B734-07FB405800CE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:liferay:digital_experience_platform:2023.q4.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "30B27CBE-14BA-4EBB-8B74-91DD1228A1F5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:liferay:digital_experience_platform:2023.q4.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "81EDBB1C-9EBB-4FAD-ADAC-B5A890BB3F50",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "0C3BA0B4-F774-49CA-8663-9DC67391864F",
              "versionEndExcluding": "7.4.3.112",
              "versionStartIncluding": "7.4.1",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Insecure Direct Object Reference (IDOR) vulnerability with account addresses in Liferay Portal 7.4.3.4 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92 allows remote authenticated users to from one account to view addresses from a different account via the _com_liferay_account_admin_web_internal_portlet_AccountEntriesAdminPortlet_addressId parameter."
    }
  ],
  "id": "CVE-2025-62242",
  "lastModified": "2025-11-07T19:11:06.160",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "LOW",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "LOW",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security@liferay.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-10-13T20:15:34.243",
  "references": [
    {
      "source": "security@liferay.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62245"
    }
  ],
  "sourceIdentifier": "security@liferay.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        }
      ],
      "source": "security@liferay.com",
      "type": "Primary"
    }
  ]
}

CVE-2025-62242 (GCVE-0-2025-62242)

Vulnerability from cvelistv5 – Published: 2025-10-13 19:10 – Updated: 2025-10-14 15:07

Summary

Severity ?

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

CWE

CWE-639 - Authorization Bypass Through User-Controlled Key

Assigner

Liferay

References

URL

Tags

https://liferay.dev/portal/security/known-vulnera…

Impacted products

Vendor

Product

Version

Liferay

Portal

Affected: 7.4.3.4 , ≤ 7.4.3.111 (maven)

Liferay

DXP

Affected: 7.4.13 , ≤ 7.4.13-u92 (maven)
Affected: 2023.Q3.1 , ≤ 2023.Q3.8 (maven)
Affected: 2023.Q4.0 , ≤ 2023.Q4.5 (maven)

Credits

foobar7

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-62242",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-14T15:07:23.233189Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-14T15:07:31.251Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Portal",
          "vendor": "Liferay",
          "versions": [
            {
              "lessThanOrEqual": "7.4.3.111",
              "status": "affected",
              "version": "7.4.3.4",
              "versionType": "maven"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "DXP",
          "vendor": "Liferay",
          "versions": [
            {
              "lessThanOrEqual": "7.4.13-u92",
              "status": "affected",
              "version": "7.4.13",
              "versionType": "maven"
            },
            {
              "lessThanOrEqual": "2023.Q3.8",
              "status": "affected",
              "version": "2023.Q3.1",
              "versionType": "maven"
            },
            {
              "lessThanOrEqual": "2023.Q4.5",
              "status": "affected",
              "version": "2023.Q4.0",
              "versionType": "maven"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "foobar7"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Insecure Direct Object Reference (IDOR) vulnerability with account addresses in Liferay Portal 7.4.3.4 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92 allows remote authenticated users to from one account to view addresses from a different account via the _com_liferay_account_admin_web_internal_portlet_AccountEntriesAdminPortlet_addressId parameter."
            }
          ],
          "value": "Insecure Direct Object Reference (IDOR) vulnerability with account addresses in Liferay Portal 7.4.3.4 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92 allows remote authenticated users to from one account to view addresses from a different account via the _com_liferay_account_admin_web_internal_portlet_AccountEntriesAdminPortlet_addressId parameter."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-13T19:10:30.348Z",
        "orgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
        "shortName": "Liferay"
      },
      "references": [
        {
          "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62245"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
    "assignerShortName": "Liferay",
    "cveId": "CVE-2025-62242",
    "datePublished": "2025-10-13T19:10:30.348Z",
    "dateReserved": "2025-10-09T20:58:49.217Z",
    "dateUpdated": "2025-10-14T15:07:31.251Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

FKIE_CVE-2025-62242

CVE-2025-62242 (GCVE-0-2025-62242)

Tags

Sightings

Nomenclature