Vulnerability Database
296,853
Total vulnerabilities in the database
CVE-2025-62257
Password enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions allows remote attackers to determine a user’s password even if account lockout is enabled via brute force attack.
| Software | From | Fixed in |
|---|---|---|
com.liferay.portal / release.portal.bom
|
7.4.0-ga1 | 7.4.3.120 |
- https://github.com/liferay/liferay-portal/commit/45cffd5030ab78e8b005d9cfd6284311da978c68
- https://github.com/liferay/liferay-portal/commit/924a0a47007665693fe2d29623cb48a426a80266
- https://github.com/liferay/liferay-portal/commit/d21627ac07561c5063f611be631e63ff502ec8e7
- https://liferay.atlassian.net/browse/LPE-17692
- https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62257
Deep Security Visibility Without the Complexity
SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.
- No setup fees
- 5-min deployment
- Cancel anytime