CVE-2025-62260

Description

Liferay Portal 7.4.0 through 7.4.3.99, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions does not limit the number of objects returned from Headless API requests, which allows remote attackers to perform denial-of-service (DoS) attacks on the application by executing a request that returns a large number of objects.

Risk Information

Base Score

7.5

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Score

Exploitation Probability

0.206

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2025-62260,CVE-2025-62261 are fixed in Liferay - release.portal.bom 7.4.3.100	Windows
Vulnerabilities CVE-2025-62260,CVE-2025-62261 are fixed in Liferay - release.portal.bom for Linux 7.4.3.100	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234