CVE-2025-3639

State: Published
Severity: 2.0 Low
Published: Aug 18, 2025
Updated: Aug 18, 2025
Reserved: Apr 15, 2025

Description

Liferay Portal 7.3.0 through 7.4.3.132, and Liferay DXP 2025.Q1 through 2025.Q1.6, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, 7.4 GA through update 92 and 7.3 GA through update 36 allows unauthenticated users with valid credentials to bypass the login process by changing the POST method to GET, once the site has MFA enabled.

Scores

CVSS	Score	Vector	Source
4.0	2.0 Low	CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L	Liferay

Weaknesses

CWE-288 Authentication Bypass Using an Alternate Path or Channel

Affected Products

Product	Versions
PortalLiferay	7.3.0 through 7.4.3.132Affected
DXPLiferay	7.3.10 through 7.3.10-u36Affected 7.4.13 through 7.4.13-u92Affected 2024.Q1.1 through 2024.Q1.15Affected 2024Q2.0 through 2023.Q2.13Affected 2024.Q3.1 through 2024.Q3.13Affected 2024.Q4.0 through 2024.Q4.7Affected 2025.Q1.0 through 2025.Q1.6Affected

References

https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-3639

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.