CVE-2025-62257: 
Java Análise e mitigação de vulnerabilidades

CVE-2025-62257 is a password enumeration vulnerability discovered in Liferay Portal and Liferay DXP, disclosed on October 29, 2025. The vulnerability affects Liferay Portal versions 7.4.0 through 7.4.3.119 and older unsupported versions, as well as Liferay DXP versions 2024.Q1 through 2024.Q1.5, 2023.Q3, 2023.Q4, and 7.4 and older unsupported versions (Liferay Advisory).

The vulnerability allows remote attackers to determine a user's password through brute force attacks, even when account lockout mechanisms are enabled. The severity of this vulnerability has been rated at 6.3 based on the CVSS v4.0 scoring system with the following vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N (Liferay Advisory).

The vulnerability enables attackers to bypass the account lockout security mechanism, potentially leading to unauthorized access to user accounts through password enumeration attacks (Liferay Advisory).

Fixed versions have been released to address this vulnerability. Organizations should upgrade to Liferay Portal version 7.4.3.120 or Liferay DXP versions 2024.Q4.0, 2024.Q3.0, 2024.Q2.0, or 2024.Q1.6 (Liferay Advisory).