The Document Library and the Adaptive Media modules in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions uses an incorrect cache-control header, which allows local users to obtain access to downloaded files via the browser's cache.
References
| Link | Resource |
|---|---|
| https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62276 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
10 Nov 2025, 16:29
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.5 |
| CPE | cpe:2.3:a:liferay:digital_experience_platform:2023.q3.5:*:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:*:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:2023.q4.1:*:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:2023.q4.6:*:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:2023.q4.2:*:*:*:*:*:*:* cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:2023.q4.4:*:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:2023.q4.10:*:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:2023.q4.3:*:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:2023.q4.7:*:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:2023.q4.5:*:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:2023.q3.9:*:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:2023.q3.10:*:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:2023.q4.0:*:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:2023.q3.1:*:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:2023.q3.8:*:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:2023.q4.8:*:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:2023.q3.6:*:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:2023.q3.2:*:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:2023.q3.7:*:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:2023.q3.4:*:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:2023.q3.3:*:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:2023.q4.9:*:*:*:*:*:*:* |
|
| First Time |
Liferay
Liferay digital Experience Platform Liferay liferay Portal |
|
| References | () https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62276 - Vendor Advisory |
01 Nov 2025, 00:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-11-01 00:15
Updated : 2025-11-10 16:29
NVD link : CVE-2025-62276
Mitre link : CVE-2025-62276
CVE.ORG link : CVE-2025-62276
JSON object : View
Products Affected
liferay
- liferay_portal
- digital_experience_platform
CWE
CWE-525
Use of Web Browser Cache Containing Sensitive Information