CVE-2025-62257: Liferay Portal Password Enumeration Vulnerability
Summary
CVE-2025-62257: Liferay Portal vulnerable to password enumeration. Affects com.liferay.portal:release.portal.bom versions >= 7.4.0-ga1, < 7.4.3.120. Fixed in 7.4.3.120. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Liferay Portal is a popular open-source platform for building web applications and managing content. It provides a robust set of features for enterprise-level applications, including user management, content management, and collaboration tools. However, certain versions of Liferay Portal are vulnerable to a password enumeration issue, which can be exploited by attackers to gain unauthorized access to user accounts.
Vulnerability Detail
The vulnerability exists in Liferay Portal versions 7.4.0 through 7.4.3.119 and older unsupported versions, as well as Liferay DXP versions 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10, and 2023.Q3.1 through 2023.Q3.10. This flaw allows remote attackers to perform brute force attacks to determine a user's password, even if account lockout mechanisms are enabled. The potential ramifications include unauthorized access to user accounts, data breaches, and compromise of sensitive information.
How To Fix
Latest published version: 7.4.3.132 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.4.3.120
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider implementing additional security measures such as rate limiting login attempts, using CAPTCHA on login forms, or employing multi-factor authentication to mitigate the risk of brute force attacks.
Conclusion
The password enumeration vulnerability in Liferay Portal poses a significant risk to user accounts and sensitive data. It is crucial for users of affected versions to update to the patched version to mitigate this risk. Implementing additional security measures can also help protect against potential attacks.
See every vulnerability recorded for com.liferay.portal:release.portal.bom →
FAQ
Password enumeration is a technique used by attackers to determine valid usernames and passwords by exploiting vulnerabilities in the authentication process.
Liferay Portal versions 7.4.0 through 7.4.3.119 and older unsupported versions are affected, along with specific versions of Liferay DXP.
The vulnerability allows attackers to gain unauthorized access to user accounts, potentially leading to data breaches and exposure of sensitive information.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
The CVSS score of this vulnerability is 6.3, indicating a moderate level of risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.liferay.portal:release.portal.bom.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
