CVE-2025-62262: Information Exposure Vulnerability in com.liferay.portal.security.ldap.impl Package
Summary
CVE-2025-62262: Information exposure through log file vulnerability in LDAP import feature in Liferay Portal 7.4.0 through 7.4.3.97, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92,... Affects com.liferay:com.liferay.portal.security.ldap.impl versions >= 4.0.2, < 4.0.54. Fixed in 4.0.54. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The com.liferay.portal.security.ldap.impl package is part of the Liferay Portal, a popular open-source platform for building web applications and websites. This package specifically handles LDAP (Lightweight Directory Access Protocol) imports, allowing organizations to integrate user data from LDAP directories into the Liferay system. The package is designed to enhance security by managing user authentication and authorization through LDAP. However, it has been found vulnerable to information exposure, which can lead to unauthorized access to sensitive user information.
Vulnerability Detail
The vulnerability identified as CVE-2025-62262 arises from an information exposure through log files in the LDAP import feature of Liferay Portal versions 7.4.0 to 7.4.3.97 and older unsupported versions, as well as Liferay DXP versions 2023.Q3.1 to 2023.Q3.4. This issue allows local users to access log files that may contain sensitive information, specifically user email addresses. The exposure occurs due to improper handling of logging mechanisms, which can inadvertently reveal user data to unauthorized individuals within the local environment.
How To Fix
Minimum fixed version
4.0.54
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to log files to prevent unauthorized users from viewing sensitive information. This can be done by modifying the file permissions of the log directory to limit access only to authorized personnel.
Conclusion
CVE-2025-62262 is a significant vulnerability in the com.liferay.portal.security.ldap.impl package that exposes user email addresses through log files. It is crucial for users of affected Liferay versions to update to the patched version 4.0.54 to mitigate this risk. Implementing file permission restrictions can serve as a temporary measure until the update is completed.
See every vulnerability recorded for com.liferay:com.liferay.portal.security.ldap.impl →
FAQ
CVE-2025-62262 is a vulnerability in the com.liferay.portal.security.ldap.impl package that allows local users to view sensitive user email addresses through log files.
The vulnerability affects Liferay Portal versions 7.4.0 to 7.4.3.97, older unsupported versions, and Liferay DXP versions 2023.Q3.1 to 2023.Q3.4.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update to the patched version, consider implementing file permission restrictions as a temporary workaround to limit access to log files.
The primary risk is unauthorized access to sensitive user information, which can lead to privacy breaches and potential misuse of user data.
Related vulnerabilities
Recent vulnerabilities recorded for com.liferay:com.liferay.portal.security.ldap.impl.
