CVE-2025-3586

Estado: AnalizadaAlta (7.5)—

In Liferay Portal 7.4.3.27 through 7.4.3.42, and Liferay DXP 2024.Q1.1 through 2024.Q1.20, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 update 27 through update 42 (Liferay PaaS, and Liferay Self-Hosted), the Objects module does not restrict the use of Groovy scripts in Object actions for Admin Users. This allows remote authenticated admin users with the Instance Administrator role to execute arbitrary Groovy scripts (i.e., remote code execution) through Object actions.

In contrast, in Liferay DXP (Liferay SaaS), the use of Groovy in Object actions is not allowed due to the high security risks it poses.

Leer descripción completaMostrar menos

Starting from Liferay DXP 2024.Q2 and later, a new feature has been introduced in Instance Settings that allows administrators to configure whether Groovy scripts are allowed in their instances.

CVSS

Versión: 4.0
Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Puntuación base: 7.5

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.42%
Percentil entre todas las CVEs puntuadas: 34
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1210 Exploitation of Remote Serviceslateral movement85 %
Impacto principalT1059 Command and Scripting Interpreterexecution90 %
Impacto secundarioT1078 Valid Accountsstealth · persistence · privilege escalation · initial access75 %

Acceso de red con privilegios elevados (PR:H) permite ejecución remota de scripts Groovy por administradores autenticados en el módulo Objects de Liferay, confirmando T1210. El impacto principal es T1059 (ejecución arbitraria de código), y secundario T1078 (abuso de cuentas administrativas).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account Management Disable or Remove Feature or Program Application Developer Guidance Active Directory Configuration Vulnerability Scanning User Training

Tecnologías afectadas (2)

Liferay — Digital Experience Platform Liferay — Liferay Portal

CWE

CWE-863

Referencias

https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-3586

JSON original (NVD)

Mostrar

{
  "id": "CVE-2025-3586",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-3586",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-09-03T03:55:32.956265Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.2,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.2
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "security@liferay.com",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 7.5,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "attackRequirements": "NONE",
          "privilegesRequired": "HIGH",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "HIGH",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "HIGH",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "security@liferay.com",
      "affectedData": [
        {
          "vendor": "Liferay",
          "product": "Portal",
          "versions": [
            {
              "status": "affected",
              "version": "7.4.3.27",
              "versionType": "maven",
              "lessThanOrEqual": "7.4.3.42"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Liferay",
          "product": "DXP",
          "versions": [
            {
              "status": "affected",
              "version": "7.4.13-u27",
              "versionType": "maven",
              "lessThanOrEqual": "7.4.13-u42"
            },
            {
              "status": "affected",
              "version": "2023.Q3.1",
              "versionType": "maven",
              "lessThanOrEqual": "2023.Q3.10"
            },
            {
              "status": "affected",
              "version": "2023.Q4.0",
              "versionType": "maven",
              "lessThanOrEqual": "2023.Q4.10"
            },
            {
              "status": "affected",
              "version": "2024.Q1.1",
              "versionType": "maven",
              "lessThanOrEqual": "2024.Q1.20"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-09-01T18:15:29.127",
  "references": [
    {
      "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-3586",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@liferay.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@liferay.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In Liferay Portal 7.4.3.27 through 7.4.3.42, and Liferay DXP 2024.Q1.1 through 2024.Q1.20, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 update 27 through update 42 (Liferay PaaS, and Liferay Self-Hosted), the Objects module does not restrict the use of Groovy scripts in Object actions for Admin Users. This allows remote authenticated admin users with the Instance Administrator role to execute arbitrary Groovy scripts (i.e., remote code execution) through Object actions. \n\nIn contrast, in Liferay DXP (Liferay SaaS), the use of Groovy in Object actions is not allowed due to the high security risks it poses. \n\nStarting from Liferay DXP 2024.Q2 and later, a new feature has been introduced in Instance Settings that allows administrators to configure whether Groovy scripts are allowed in their instances."
    }
  ],
  "lastModified": "2026-06-17T09:20:15.057",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DB698493-4763-4E87-9764-BC36906CCF5C",
              "versionEndIncluding": "2023.Q3.10",
              "versionStartIncluding": "2023.Q3.1"
            },
            {
              "criteria": "cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "99FC3415-FBE2-43BC-944A-72C0885453D1",
              "versionEndIncluding": "2023.q4.10",
              "versionStartIncluding": "2023.q4.0"
            },
            {
              "criteria": "cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1389E586-D037-4D4A-B090-CA89AD912263",
              "versionEndIncluding": "2024.Q1.20",
              "versionStartIncluding": "2024.Q1.1"
            },
            {
              "criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update27:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A5823BC0-8C11-4C31-9E99-3C9D82918E2A"
            },
            {
              "criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update28:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E2E6CB66-1AE1-4626-8070-64C250ED8363"
            },
            {
              "criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update29:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B63449AA-6831-4290-B1FA-0BB806820402"
            },
            {
              "criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update30:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B3B169F6-B8B8-4612-AD7D-F75CC6A9297B"
            },
            {
              "criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update31:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "12D46756-D26D-4877-ACE8-1C2721908428"
            },
            {
              "criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update32:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5403DCEF-20C2-4568-8DF1-30804F522915"
            },
            {
              "criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update33:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "90E39742-90BE-4DEB-AB78-F9B8F7333F9A"
            },
            {
              "criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update34:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9D07DB20-9DCF-4C05-99D2-F6B37A082C14"
            },
            {
              "criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update35:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "341D1157-8118-4BD3-A902-36E90E066706"
            },
            {
              "criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update36:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1AB71307-7EAA-436A-9CBC-5A94F034FB48"
            },
            {
              "criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update37:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9446B3A5-6647-416C-92AF-7B6E0E929765"
            },
            {
              "criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update38:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "06386C7A-CAA1-4FC4-9182-5A66342FB903"
            },
            {
              "criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update39:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8C84B701-B9A1-43D0-AF0C-30EDBD24CF90"
            },
            {
              "criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update40:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BA9AF651-D118-4437-B400-531B26BF6801"
            },
            {
              "criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update41:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2B256485-E289-4092-B45B-835DE12625B9"
            },
            {
              "criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update42:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "119B54BD-75F4-46A4-A57D-16CFF4E12CEB"
            },
            {
              "criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4FC96BCE-9523-4357-843A-442262E629B3",
              "versionEndExcluding": "7.4.3.43",
              "versionStartIncluding": "7.4.3.27"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@liferay.com"
}