Open redirect vulnerability in page administration in Liferay Portal 7.4.0 through 7.4.3.97, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to redirect users to arbitrary external URLs via the _com_liferay_layout_admin_web_portlet_GroupPagesPortlet_redirect parameter.
References
| Link | Resource |
|---|---|
| https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62253 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
12 Dec 2025, 20:42
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62253 - Vendor Advisory | |
| First Time |
Liferay
Liferay liferay Portal Liferay digital Experience Platform |
|
| CPE | cpe:2.3:a:liferay:digital_experience_platform:2023.q3.1:*:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.3:update4:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:-:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.3:fix_pack_2:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.3:update2:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.3:fix_pack_1:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.3:update25:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.3:update11:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:2023.q3.2:*:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.3:update34:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.3:update23:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.3:update14:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.3:update21:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.3:update7:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.3:service_pack_3:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.3:update32:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:2023.q3.4:*:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.3:update22:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.3:update10:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.3:update19:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.3:update6:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.3:update17:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.3:update20:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.3:update18:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.3:update1:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.3:update24:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.3:update33:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.3:update5:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.3:update28:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.3:update16:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.3:update9:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.3:update15:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.3:update12:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.3:update13:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.3:update26:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.3:update29:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.3:update8:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.3:update3:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.3:update27:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.3:update31:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.3:update30:*:*:*:*:*:* cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.3:service_pack_2:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.3:service_pack_1:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.3:-:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:2023.q3.3:*:*:*:*:*:*:* |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.1 |
27 Oct 2025, 19:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-10-27 19:16
Updated : 2025-12-12 20:42
NVD link : CVE-2025-62253
Mitre link : CVE-2025-62253
CVE.ORG link : CVE-2025-62253
JSON object : View
Products Affected
liferay
- digital_experience_platform
- liferay_portal
CWE
CWE-601
URL Redirection to Untrusted Site ('Open Redirect')