CVE-2025-3639: Liferay Portal Login Bypass Vulnerability – CVSS 2.0 · Watchpost

← All vulnerabilities

Liferay Portal Login Bypass Vulnerability

낮음 2.0CVE-2025-3639 · GHSA-g4wg-mpfg-x2q6 · Published 18/08/2025 · updated 17/06/2026

요약

CVE-2025-3639은(는) com.liferay.portal:release.portal.bom에 영향을 주는 낮음 (CVSS 2.0) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 0.50%, 전체 취약점의 43.0%보다 높음.
아직 패치 버전 정보가 없습니다. 참고 자료의 공급업체 권고를 확인하세요.

Package	Affected versions	Patched versions
com.liferay.portal:release.portal.bom Maven	`≥ 7.3.0-ga1, ≤ 7.4.3.132-ga132`	No fix yet

Description

Liferay Portal 7.3.0 through 7.4.3.132, and Liferay DXP 2025.Q1 through 2025.Q1.6, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, 7.4 GA through update 92 and 7.3 GA through update 36 allows unauthenticated users with valid credentials to bypass the login process by changing the POST method to GET, once the site has MFA enabled.

NVD description

Liferay Portal 7.3.0 through 7.4.3.132, and Liferay DXP 2025.Q1 through 2025.Q1.6, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, 7.4 GA through update 92 and 7.3 GA through update 36 allows unauthenticated users with valid credentials to bypass the login process by changing the POST method to GET, once the site has MFA enabled.

References

nvd.nist.gov/vuln/detail/CVE-2025-3639 · ADVISORY
liferay/liferay-portal commit 383a400 · WEB
liferay/liferay-portal commit 774c89c · WEB
liferay/liferay-portal commit 7a70daf · WEB
liferay/liferay-portal commit a0265c3 · WEB
liferay/liferay-portal commit a5081fe · WEB
liferay/liferay-portal commit d2806ad · WEB
liferay/liferay-portal commit e4bb21b · WEB
liferay/liferay-portal commit e67b47a · WEB
liferay/liferay-portal commit eb04575

com.liferay.portal:release.portal.bom의 다른 취약점

모두 보기 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free