CVE-2025-4604: 
Java vulnerability analysis and mitigation

CVE-2025-4604 is a CAPTCHA bypass vulnerability affecting Liferay Portal and Liferay DXP platforms. The vulnerability was discovered on May 12, 2025, by Gareth Catterall from the AnchorSec security team. The affected versions include Liferay Portal 7.4.3.80 through 7.4.3.132, and multiple versions of Liferay DXP ranging from 2024.Q1.1 through 2025.Q1.15, as well as DXP 7.4 updates 80 through 92 (Liferay Advisory).

The vulnerability allows attackers to bypass the CAPTCHA verification mechanism in the affected Liferay installations. The CVSS v4.0 score is 6.9 (Medium), with the vector string CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) (NVD).

Upon successful exploitation, attackers can bypass the CAPTCHA protection mechanism and execute scripts in the Gogo shell. This could lead to unauthorized access to system functionality and potential system compromise (Liferay Advisory).

The vulnerability has been fixed in Liferay Portal's master branch and Liferay DXP 2025.Q2.0. Organizations using affected versions should upgrade to the fixed versions to mitigate this vulnerability (Liferay Advisory).