GHSA-cqwv-9xh5-25fg

Liferay Portal and DXP are Missing Authorization in Collection Provider

Source: GitHub Advisory Database (reviewed) Low CVE-2025-62247

Packages

Ecosystem	Package	Affected	Fixed in
Maven	com.liferay:com.liferay.search.experiences.service	<= 3.0.84	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Missing Authorization in Collection Provider component in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19 allows instance users to read and select unauthorized Blueprints through the Collection Providers across instances.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2025-62247 advisory
https://github.com/liferay/liferay-portal/commit/019d703943ef58fb7bd3f30fe680c02c2756f86b web
https://github.com/liferay/liferay-portal package
https://liferay.atlassian.net/browse/LPE-18297 web
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62247 web