logo

Database

Security controls bypass or absence In com.liferay.portal:release.portal.bom

Description

Liferay Portal Login Bypass Vulnerability Liferay Portal 7.3.0 through 7.4.3.132, and Liferay DXP 2025.Q1 through 2025.Q1.6, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, 7.4 GA through update 92 and 7.3 GA through update 36 allows unauthenticated users with valid credentials to bypass the login process by changing the POST method to GET, once the site has MFA enabled.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Package
Affected version

Aliases

1. CVE-2025-36392. NVD-2025-36393. OSV-2025-36394. GCVE-2025-3639

References

1. https://github.com/liferay/liferay-portal/commit/383a4001cfdf533eb077ed6f03bc5f8fed27cf052. https://github.com/liferay/liferay-portal/commit/774c89c853d4b9d9abb61d6e079dab21f582cc783. https://github.com/liferay/liferay-portal/commit/7a70daf60416d536a45fe137d54e1054e9394fa74. https://github.com/liferay/liferay-portal/commit/a0265c3847af01a37d2a9ad1560e4408f28565185. https://github.com/liferay/liferay-portal/commit/a5081fefaffdd86a9306320c46e91f98973c39cb6. https://github.com/liferay/liferay-portal/commit/d2806ad26cb194d0c7d654f9c447857e05dd44b27. https://github.com/liferay/liferay-portal/commit/e4bb21b85440157b588ebbd217995113362962cc8. https://github.com/liferay/liferay-portal/commit/e67b47a47f3bccc9a85aeee6a40cd0188787aa0f9. https://github.com/liferay/liferay-portal/commit/eb0457503fdb8ac49c662b690a6a4eb139ee4c6710. https://liferay.atlassian.net/browse/LPE-1821211. https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-363912. https://github.com/6lj/CVE-2025-3639

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.