Read the docs
TI-2025-38578 Aliases CVE-2025-62276GHSA-6533-fhr2-f38h

The Document Library and the Adaptive Media modules in Liferay Portal 7.4.0 through…

Priority LOW 20CWE-525Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

The Document Library and the Adaptive Media modules in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions uses an incorrect cache-control header, which allows local users to obtain access to downloaded files via the browser's cache.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00134 2nd percentileScored 2026-11-07
Fix Fixed com.liferay:com.liferay.adaptive.media.web (Maven): 5.0.52com.liferay.portal:com.liferay.portal.impl (Maven): 69.1.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
LiferayPortal7.4.0 – 7.4.3.111—No fix listedCNA
LiferayDXP7.4.13 – 7.4.13-u92; 2023.Q3.1 – 2023.Q3.10; 2023.Q4.0 – 2023.Q4.10—No fix listedCNA
—com.liferay:com.liferay.adaptive.media.web (Maven)before 5.0.525.0.52Patch availableGHSA-6533-fhr2-f38h
—com.liferay.portal:com.liferay.portal.impl (Maven)before 69.1.069.1.0Patch availableGHSA-6533-fhr2-f38h
  • Portal VendorLiferay Affected 7.4.0 – 7.4.3.111 Fixed in — No fix listed CNA
  • DXP VendorLiferay Affected 7.4.13 – 7.4.13-u92; 2023.Q3.1 – 2023.Q3.10; 2023.Q4.0 – 2023.Q4.10 Fixed in — No fix listed CNA
  • com.liferay:com.liferay.adaptive.media.web (Maven) Vendor— Affected before 5.0.52 Fixed in 5.0.52 Patch available GHSA-6533-fhr2-f38h
  • com.liferay.portal:com.liferay.portal.impl (Maven) Vendor— Affected before 69.1.0 Fixed in 69.1.0 Patch available GHSA-6533-fhr2-f38h

CPE configurations NVD · 23

CPEVersionsRoleVendor
cpe:2.3:a:liferay:digital_experience_platform:7.4:*:*:*:*:*:*:*7.4VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:2023.q3.1:*:*:*:*:*:*:*2023.q3.1VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:2023.q3.2:*:*:*:*:*:*:*2023.q3.2VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:2023.q3.3:*:*:*:*:*:*:*2023.q3.3VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:2023.q3.4:*:*:*:*:*:*:*2023.q3.4VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:2023.q3.5:*:*:*:*:*:*:*2023.q3.5VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:2023.q3.6:*:*:*:*:*:*:*2023.q3.6VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:2023.q3.7:*:*:*:*:*:*:*2023.q3.7VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:2023.q3.8:*:*:*:*:*:*:*2023.q3.8VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:2023.q3.9:*:*:*:*:*:*:*2023.q3.9VulnerableLiferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:*:*:*:*:*:*:* Versions 7.4 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:2023.q3.1:*:*:*:*:*:*:* Versions 2023.q3.1 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:2023.q3.2:*:*:*:*:*:*:* Versions 2023.q3.2 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:2023.q3.3:*:*:*:*:*:*:* Versions 2023.q3.3 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:2023.q3.4:*:*:*:*:*:*:* Versions 2023.q3.4 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:2023.q3.5:*:*:*:*:*:*:* Versions 2023.q3.5 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:2023.q3.6:*:*:*:*:*:*:* Versions 2023.q3.6 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:2023.q3.7:*:*:*:*:*:*:* Versions 2023.q3.7 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:2023.q3.8:*:*:*:*:*:*:* Versions 2023.q3.8 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:2023.q3.9:*:*:*:*:*:*:* Versions 2023.q3.9 Vulnerable ·Liferay
Show 13 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:liferay:digital_experience_platform:2023.q3.10:*:*:*:*:*:*:*2023.q3.10VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:2023.q4.0:*:*:*:*:*:*:*2023.q4.0VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:2023.q4.1:*:*:*:*:*:*:*2023.q4.1VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:2023.q4.2:*:*:*:*:*:*:*2023.q4.2VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:2023.q4.3:*:*:*:*:*:*:*2023.q4.3VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:2023.q4.4:*:*:*:*:*:*:*2023.q4.4VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:2023.q4.5:*:*:*:*:*:*:*2023.q4.5VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:2023.q4.6:*:*:*:*:*:*:*2023.q4.6VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:2023.q4.7:*:*:*:*:*:*:*2023.q4.7VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:2023.q4.8:*:*:*:*:*:*:*2023.q4.8VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:2023.q4.9:*:*:*:*:*:*:*2023.q4.9VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:2023.q4.10:*:*:*:*:*:*:*2023.q4.10VulnerableLiferay
cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*7.4.0 to before 7.4.3.112VulnerableLiferay
  • cpe:2.3:a:liferay:digital_experience_platform:2023.q3.10:*:*:*:*:*:*:* Versions 2023.q3.10 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:2023.q4.0:*:*:*:*:*:*:* Versions 2023.q4.0 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:2023.q4.1:*:*:*:*:*:*:* Versions 2023.q4.1 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:2023.q4.2:*:*:*:*:*:*:* Versions 2023.q4.2 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:2023.q4.3:*:*:*:*:*:*:* Versions 2023.q4.3 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:2023.q4.4:*:*:*:*:*:*:* Versions 2023.q4.4 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:2023.q4.5:*:*:*:*:*:*:* Versions 2023.q4.5 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:2023.q4.6:*:*:*:*:*:*:* Versions 2023.q4.6 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:2023.q4.7:*:*:*:*:*:*:* Versions 2023.q4.7 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:2023.q4.8:*:*:*:*:*:*:* Versions 2023.q4.8 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:2023.q4.9:*:*:*:*:*:*:* Versions 2023.q4.9 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:2023.q4.10:*:*:*:*:*:*:* Versions 2023.q4.10 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:* Versions 7.4.0 to before 7.4.3.112 Vulnerable ·Liferay

Remediation

  • Fix · GHSA-6533-fhr2-f38h com.liferay:com.liferay.adaptive.media.web (Maven) Fixed in 5.0.52 Advisory →
  • Fix · GHSA-6533-fhr2-f38h com.liferay.portal:com.liferay.portal.impl (Maven) Fixed in 69.1.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-62276
  2. 2026-10-03 Alias added: GHSA-6533-fhr2-f38h

References

Advisory 2

Other 4

  • TI-2023-22732 Cross-site scripting in Liferay DXP CVSS 3.1CRITICAL 9.6
  • TI-2022-20403 A SQL injection vulnerability in the Layout module in Liferay Portal 7.1.3 through… CVSS 3.1HIGH 8.8
  • TI-2025-03097 Uncontrolled resource consumption in Liferay Portal CVSS 4.0HIGH 8.7
  • TI-2025-03169 Uncontrolled resource consumption in Liferay Portal CVSS 4.0HIGH 8.7
  • TI-2024-17354 Cross-site scripting in Liferay Portal CVSS 3.1CRITICAL 9.6
  • TI-2024-16598 Cross-site scripting in Liferay Portal CVSS 3.1CRITICAL 9.6
See all 263 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences