CVE-2025-62266

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.4.0 through 7.4.3.119 Liferay DXP versions 2023.Q3.1 through 2023.Q4.10 Liferay DXP versions 2024.Q1.1 through 2024.Q1.5 Liferay Portal versions 7.4 GA through update 92 Older unsupported versions

Description The software is susceptible to DNS rebinding attacks, which could allow remote attackers to redirect users to arbitrary external URLs. The redirect URL security is, by default, configured to use IP, which enables this issue.

Recommendations Change the redirect URL security from IP to domain for Liferay Portal versions 7.4.0 through 7.4.3.119. Change the redirect URL security from IP to domain for Liferay DXP versions 2023.Q3.1 through 2023.Q4.10. Change the redirect URL security from IP to domain for Liferay DXP versions 2024.Q1.1 through 2024.Q1.5. Change the redirect URL security from IP to domain for Liferay Portal versions 7.4 GA through update 92. Change the redirect URL security from IP to domain for older unsupported versions.