CVE-2025-62243

Insecure direct object reference (IDOR) vulnerability in Publications in Liferay Portal 7.4.1 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92 allows remote authenticated attackers to view publication comments via the _com_liferay_change_tracking_web_portlet_PublicationsPortlet_value parameter. Publications comments in Liferay Portal 7.4.1 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92 does not properly check user permissions, which allows remote authenticated users to edit publication comments via crafted URLs.

We have discovered 67 live websites that are affected by CVE-2025-62243.

Run a Free Instant Scan



Affected Software

Product  Liferay
Category Content Management System
Vulnerable Domains67 live websites (2.01% of Liferay install base)
Vulnerable Versions
  • from 7.4.1 through 7.4.3.112
Vulnerable Versions Count15 versions ( 25% of all versions)


Common Weakness Enumeration

CWE-863 Incorrect Authorization



Details

  • Published - Oct 13, 2025
  • Updated - Oct 14, 2025

Credits

  • foobar7 (reporter)

Website Distribution by Country

Number of websites using CVE-2025-62243
United States9 websites


Italy13 websites
Spain9 websites
Germany7 websites
Poland7 websites
Brazil3 websites
GB3 websites
Portugal3 websites
France2 websites
Argentina1 websites

Website Distribution by TLD

Number of websites using CVE-2025-62243
.com12 websites
.it10 websites
.pl7 websites
.es6 websites
.org5 websites
.de4 websites
.co.uk3 websites
.net2 websites
.be1 websites
.cz1 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2025-62243

Top websites that are affected by CVE-2025-62243. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
****.***.it Italy**,***
*****.**.***.br Brazil***,***
***.it Italy***,***
*****.org Singapore***,***
*******.org Spain***,***
******.****.***.it Italy***,***
*****.****.***.it Italy***,***
***********.*****.pl Poland***,***
**.**.***.br Brazil***,***
*******.net Italy***,***
See full domain list

FAQ

CVE-2025-62243 is Incorrect Authorization in Liferay
A total of 67 websites have been identified as vulnerable to CVE-2025-62243, based on global website indexing conducted by WebTechSurvey.
The Liferay is affected by the CVE-2025-62243 vulnerability.
Liferay versions up to and including 7.4.3.112 are vulnerable to CVE-2025-62243.