Insecure Direct Object Reference (IDOR) vulnerability with account addresses in Liferay Portal 7.4.3.4 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92 allows remote authenticated users to from one account to view addresses from a different account via the _com_liferay_account_admin_web_internal_portlet_AccountEntriesAdminPortlet_addressId parameter.
References
| Link | Resource |
|---|---|
| https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62245 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
07 Nov 2025, 19:11
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Liferay
Liferay digital Experience Platform Liferay liferay Portal |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 4.3 |
| CPE | cpe:2.3:a:liferay:digital_experience_platform:2023.q3.5:*:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:*:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:2023.q4.1:*:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:2023.q4.2:*:*:*:*:*:*:* cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:2023.q4.4:*:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:2023.q4.3:*:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:2023.q4.5:*:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:2023.q3.9:*:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:2023.q3.10:*:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:2023.q3.1:*:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:2023.q3.8:*:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:2023.q3.3:*:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:2023.q3.6:*:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:2023.q3.2:*:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:2023.q3.4:*:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:2023.q3.7:*:*:*:*:*:*:* |
|
| References | () https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62245 - Vendor Advisory |
13 Oct 2025, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-10-13 20:15
Updated : 2025-11-07 19:11
NVD link : CVE-2025-62242
Mitre link : CVE-2025-62242
CVE.ORG link : CVE-2025-62242
JSON object : View
Products Affected
liferay
- liferay_portal
- digital_experience_platform
CWE
CWE-639
Authorization Bypass Through User-Controlled Key