CVE-2025-4604: Liferay Portal CAPTCHA Bypass Vulnerability in com.liferay.captcha.impl
Summary
CVE-2025-4604: Liferay Portal CAPTCHA Bypass for Gogo Shell. Affects com.liferay:com.liferay.captcha.impl versions < 4.0.17. Fixed in 4.0.17. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package com.liferay.captcha.impl is part of the Liferay Portal, which is a popular open-source platform for building web applications and managing content. This package specifically handles CAPTCHA functionality, which is designed to prevent automated scripts from abusing web forms. The vulnerability in question allows attackers to bypass this CAPTCHA check, potentially leading to unauthorized access and execution of scripts within the Gogo shell.
Vulnerability Detail
The vulnerability arises from a flaw in the CAPTCHA implementation in Liferay Portal versions 7.4.3.80 through 7.4.3.132 and Liferay DXP versions 2024.Q1.1 through 2024.Q1.19, among others. This flaw allows attackers to bypass the CAPTCHA verification process, enabling them to execute arbitrary scripts in the Gogo shell. The implications of this vulnerability are significant, as it could lead to unauthorized access and manipulation of the system, compromising its integrity and security.
How To Fix
Minimum fixed version
4.0.17
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider implementing additional security measures such as rate limiting or IP whitelisting to mitigate the risk of automated attacks while a patch is being applied.
Conclusion
In summary, CVE-2025-4604 represents a significant security risk for users of the Liferay Portal due to its ability to bypass CAPTCHA checks. It is crucial for affected users to update to the patched version 4.0.17 of the com.liferay.captcha.impl package and consider implementing temporary security measures to protect their applications.
See every vulnerability recorded for com.liferay:com.liferay.captcha.impl →
FAQ
CVE-2025-4604 is a vulnerability in the Liferay Portal that allows attackers to bypass CAPTCHA checks, potentially leading to unauthorized access.
The vulnerability affects Liferay Portal versions 7.4.3.80 to 7.4.3.132 and various versions of Liferay DXP from 2024.Q1.1 to 2025.Q1.15.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. By simply uploading your pom.xml file, you can check for vulnerabilities without any installation.
If exploited, this vulnerability could allow attackers to execute arbitrary scripts in the Gogo shell, leading to unauthorized access and potential system compromise.
Implementing additional security measures such as rate limiting or IP whitelisting can help mitigate risks until the vulnerability is patched.
