PT-2025-41802

CVE-2025-62241

Published

2025-10-13

Updated

2026-10-08

Description by

CVSS 4.0

5.3

Medium

MetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Liferay DXP versions 2023.Q4.1 through 2023.Q4.5

Description An Insecure Direct Object Reference (IDOR) issue exists in Liferay DXP that allows authenticated remote users to access shipment addresses from different virtual instances. This occurs through the commerceOrderId parameter in the com liferay commerce order web internal portlet CommerceOrderPortlet component.

Recommendations Update Liferay DXP versions prior to 2023.Q4.6.

Exploitability

Fix

Impacts

Researchers

Foobar7

Vendors

Affected products

Weakness enumeration

CWE-639: Authorization Bypass Through User-Controlled Key

Related identifiers

CVE-2025-62241