Log in / Sign up

Vulnerability details

CVE-2025-3586

Liferay DXPLiferay Portal
CVSS 4.0
7.5High

Official description

In Liferay Portal 7.4.3.27 through 7.4.3.42, and Liferay DXP 2024.Q1.1 through 2024.Q1.20, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 update 27 through update 42 (Liferay PaaS, and Liferay Self-Hosted), the Objects module does not restrict the use of Groovy scripts in Object actions for Admin Users. This allows remote authenticated admin users with the Instance Administrator role to execute arbitrary Groovy scripts (i.e., remote code execution) through Object actions. In contrast, in Liferay DXP (Liferay SaaS), the use of Groovy in Object actions is not allowed due to the high security risks it poses. Starting from Liferay DXP 2024.Q2 and later, a new feature has been introduced in Instance Settings that allows administrators to configure whether Groovy scripts are allowed in their instances.

CVSS scores

ScoreVersionSourceVector
7.5High 4.0 CVEProject cvelistV5 (CNA) (Liferay) CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Affected products

VendorProductVersionsSource
Liferay DXP 2023.Q3.1 ≤ v ≤ 2023.Q3.10 CVEProject cvelistV5 (CNA)
Liferay DXP 2023.Q4.0 ≤ v ≤ 2023.Q4.10 CVEProject cvelistV5 (CNA)
Liferay DXP 2024.Q1.1 ≤ v ≤ 2024.Q1.20 CVEProject cvelistV5 (CNA)
Liferay DXP 7.4.13-u27 ≤ v ≤ 7.4.13-u42 CVEProject cvelistV5 (CNA)
Liferay Portal 7.4.3.27 ≤ v ≤ 7.4.3.42 CVEProject cvelistV5 (CNA)

References and advisories

1
Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published
2025-09-01
Last updated
2026-02-26
State
Published
Assigner (CNA)
Liferay

Exploit prediction (EPSS)

0.41%
Probability of exploitation in 30 days
36.2%
Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable
No
Exploitation
None
Technical impact
Total

Weaknesses (CWE)

  • CWE-863
    Incorrect Authorization