CVE-2025-62242
Estado: AnalizadaMedia (5.3)—
Insecure Direct Object Reference (IDOR) vulnerability with account addresses in Liferay Portal 7.4.3.4 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92 allows remote authenticated users to from one account to view addresses from a different account via the _com_liferay_account_admin_web_internal_portlet_AccountEntriesAdminPortlet_addressId parameter.
CVSS
- Versión: 4.0
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Puntuación base: 5.3
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.30%
- Percentil entre todas las CVEs puntuadas: 21
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (2)
CWE
- CWE-639
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2025-62242",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2025-62242",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2025-10-14T15:07:23.233189Z"
}
}
],
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 4.3,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "LOW",
"confidentialityImpact": "LOW"
},
"impactScore": 1.4,
"exploitabilityScore": 2.8
}
],
"cvssMetricV40": [
{
"type": "Secondary",
"source": "security@liferay.com",
"cvssData": {
"Safety": "NOT_DEFINED",
"version": "4.0",
"Recovery": "NOT_DEFINED",
"baseScore": 5.3,
"Automatable": "NOT_DEFINED",
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"exploitMaturity": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"subIntegrityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"availabilityRequirement": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"subConfidentialityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"confidentialityRequirement": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED"
}
}
]
},
"affected": [
{
"source": "security@liferay.com",
"affectedData": [
{
"vendor": "Liferay",
"product": "Portal",
"versions": [
{
"status": "affected",
"version": "7.4.3.4",
"versionType": "maven",
"lessThanOrEqual": "7.4.3.111"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Liferay",
"product": "DXP",
"versions": [
{
"status": "affected",
"version": "7.4.13",
"versionType": "maven",
"lessThanOrEqual": "7.4.13-u92"
},
{
"status": "affected",
"version": "2023.Q3.1",
"versionType": "maven",
"lessThanOrEqual": "2023.Q3.8"
},
{
"status": "affected",
"version": "2023.Q4.0",
"versionType": "maven",
"lessThanOrEqual": "2023.Q4.5"
}
],
"defaultStatus": "unaffected"
}
]
}
],
"published": "2025-10-13T20:15:34.243",
"references": [
{
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62245",
"tags": [
"Vendor Advisory"
],
"source": "security@liferay.com"
}
],
"vulnStatus": "Analyzed",
"weaknesses": [
{
"type": "Secondary",
"source": "security@liferay.com",
"description": [
{
"lang": "en",
"value": "CWE-639"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Insecure Direct Object Reference (IDOR) vulnerability with account addresses in Liferay Portal 7.4.3.4 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92 allows remote authenticated users to from one account to view addresses from a different account via the _com_liferay_account_admin_web_internal_portlet_AccountEntriesAdminPortlet_addressId parameter."
}
],
"lastModified": "2026-06-17T09:51:38.187",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8E19E344-92B4-4B46-BD89-25EC7191972C"
},
{
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:2023.q3.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1EF6451A-2A5D-4222-A1C6-113AA4B8D4E6"
},
{
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:2023.q3.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9D6CE430-3C95-4855-BA44-E2E136D1FEB2"
},
{
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:2023.q3.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "44FEB149-C792-493D-B055-568FFC96298A"
},
{
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:2023.q3.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B050DD73-71B6-46CD-A35B-7ACB53BE6C6A"
},
{
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:2023.q3.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "62432289-E1DC-4013-85C7-6B77299A910F"
},
{
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:2023.q3.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0912EEFE-DC56-43F6-AE0E-A4E2A033F3C5"
},
{
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:2023.q3.7:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9398F679-5F47-4DF2-AA91-4A21126675C6"
},
{
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:2023.q3.8:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8296B54A-976A-404C-AB77-0619E4297A69"
},
{
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:2023.q3.9:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F778EB15-2AB0-44C1-BD99-9F7F1851E167"
},
{
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:2023.q3.10:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "625E6C10-D0C7-4C5D-99F8-601A7B942392"
},
{
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:2023.q4.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A27A8480-7EE1-4265-9117-D6C234ACAC5F"
},
{
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:2023.q4.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "94425688-725E-41DC-B2D3-14F2A7163AD6"
},
{
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:2023.q4.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "623CA096-BDBB-4F59-B734-07FB405800CE"
},
{
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:2023.q4.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "30B27CBE-14BA-4EBB-8B74-91DD1228A1F5"
},
{
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:2023.q4.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "81EDBB1C-9EBB-4FAD-ADAC-B5A890BB3F50"
},
{
"criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0C3BA0B4-F774-49CA-8663-9DC67391864F",
"versionEndExcluding": "7.4.3.112",
"versionStartIncluding": "7.4.1"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "security@liferay.com"
}