CVE-2025-62247: Liferay Portal and DXP Missing Authorization in Collection Provider
Summary
CVE-2025-62247: Liferay Portal and DXP are Missing Authorization in Collection Provider. Affects com.liferay:com.liferay.search.experiences.service versions < 3.0.84. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package 'com.liferay:com.liferay.search.experiences.service' is part of the Liferay Portal, a popular open-source platform for building web applications. This package provides functionalities related to search experiences within the Liferay ecosystem. It allows users to create and manage search-related features, enhancing the overall user experience. However, it has been identified to have a vulnerability that could allow unauthorized access to sensitive data.
Vulnerability Detail
The vulnerability stems from a missing authorization check in the Collection Provider component of Liferay Portal versions 7.4.0 through 7.4.3.132 and Liferay DXP versions 2025.Q2.0 through 2025.Q2.9, among others. This flaw enables instance users to read and select unauthorized Blueprints across instances, potentially leading to data leakage and unauthorized access to sensitive information. The lack of proper authorization checks can expose critical functionalities to users who should not have access, posing a security risk.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can restrict access to the Collection Provider component by implementing additional access controls at the application level. This may involve modifying user roles and permissions to limit access to sensitive features until the package can be updated.
Conclusion
In summary, CVE-2025-62247 represents a significant security vulnerability in Liferay Portal and DXP due to missing authorization checks. It is crucial for users to update to the latest patched version to mitigate risks associated with unauthorized access. Utilizing tools like Vulert can aid in monitoring and identifying vulnerabilities in your applications.
See every vulnerability recorded for com.liferay:com.liferay.search.experiences.service →
FAQ
CVE-2025-62247 is a vulnerability in Liferay Portal and DXP that allows unauthorized access to Blueprints due to missing authorization checks.
The affected versions include Liferay Portal 7.4.0 through 7.4.3.132 and Liferay DXP 2025.Q2.0 through 2025.Q2.9, among others.
You can use Vulert, which monitors and alerts for open-source vulnerabilities using just the pom.xml file. Visit Vulert Scanner to check your application without signup.
The risks include unauthorized access to sensitive data and functionalities, which can lead to data leakage and security breaches.
If immediate updates are not possible, implement additional access controls to restrict user access to the affected components as a temporary measure.
