CVE-2025-3639 Sign in via GET method when MFA enabled

Description

Liferay Portal and Liferay DXP allows unauthenticated users with valid credentials to bypass the login process by changing the POST method to GET, once the site has MFA enabled.

Severity

2.0 (CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L)

Affected Version(s)

  • Liferay Portal 7.4.0 through 7.4.3.132
  • Liferay DXP 2025.Q1.0 through 2025.Q1.6
  • Liferay DXP 2024.Q4.0 through 2024.Q4.7
  • Liferay DXP 2024.Q3.1 through 2024.Q3.13
  • Liferay DXP 2024.Q2.1 through 2024.Q2.13
  • Liferay DXP 2024.Q1.1 through 2024.Q1.15
  • Liferay DXP 7.4 GA through update 92
  • Liferay DXP 7.3 GA through update 36

Fixed Version(s)

  • Liferay Portal fixed on master branch
  • Liferay DXP 2025.Q2.0
  • Liferay DXP 2025.Q1.7
  • Liferay DXP 2024.Q1.16

Publication date: Thu, 08 May 2025 17:23:00 +0000

Security advisories for Liferay's enterprise offerings (e.g., Liferay DXP) are only listed here since 2023. Historial advisories are availabe in the Help Center.

Community
Company
Feedback