GHSA-6533-fhr2-f38h CVE-2025-62276
Liferay Portal and DXP use an incorrect cache-control header
- Severity
- 0.0 / 10
- Medium · CVSS 4.0
- Exploit chance (EPSS)
- 0.13%
- Chance of exploitation in the next 30 days. Higher than 2.90% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-525 Use of Web Browser Cache Containing Sensitive Information
- Fix
- Available
- 2 packages have a fixed version
Description
The Document Library and the Adaptive Media modules in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions uses an incorrect cache-control header, which allows local users to obtain access to downloaded files via the browser's cache.
Affected versions
Maven
| Package | Vulnerable | Fixed in |
|---|---|---|
| com.liferay.portal:com.liferay.portal.impl | < 69.1.0 |
69.1.0 |
| com.liferay:com.liferay.adaptive.media.web | < 5.0.52 |
5.0.52 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
com.liferay.portal:com.liferay.portal.impl Maven → 69.1.0
- maven
<dependency><groupId>com.liferay.portal</groupId><artifactId>com.liferay.portal.impl</artifactId><version>69.1.0</version></dependency>- gradle
implementation("com.liferay.portal:com.liferay.portal.impl:69.1.0")
com.liferay:com.liferay.adaptive.media.web Maven → 5.0.52
- maven
<dependency><groupId>com.liferay</groupId><artifactId>com.liferay.adaptive.media.web</artifactId><version>5.0.52</version></dependency>- gradle
implementation("com.liferay:com.liferay.adaptive.media.web:5.0.52")
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
- Attack vector
- Local
- Attack complexity
- Low
- Attack requirements
- None
- Privileges required
- None
- User interaction
- Active
- Confidentiality (vulnerable system)
- Low
- Integrity (vulnerable system)
- Low
- Availability (vulnerable system)
- None
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
CVSS 3.1 5.5
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Attack vector
- Local
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Weakness
CWE-525: Use of Web Browser Cache Containing Sensitive Information
The web application does not use an appropriate caching policy that specifies the extent to which each web page and associated form fields should be cached.
How to prevent it
- Architecture and Design: Protect information stored in cache.
- Implementation: Use a restrictive caching policy for forms and web pages that potentially contain sensitive information, such as "no-cache" in the Cache-Control header.
- Architecture and Design: Do not store unnecessarily sensitive information in the cache.
- Architecture and Design: Consider using encryption in the cache.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-xcj6-xpjg-c4xr Liferay Portal Stores Password Reset Tokens in Plain Text | Medium | Also affects com.liferay.portal:com.liferay.portal.impl |
| GHSA-q95h-87j6-273x Liferay Portal ComboServlet denial of service via large file combination | High | Also affects com.liferay.portal:com.liferay.portal.impl |
| GHSA-rx48-gqc2-4w47 Liferay Portal reflected cross-site scripting (XSS) vulnerability in the google_gaget | Medium | Also affects com.liferay.portal:com.liferay.portal.impl |
| GHSA-pfwq-mr9g-gq6m Liferay is Vulnerable to Authorization Bypass Through User-Controlled Key | Medium | Also affects com.liferay.portal:com.liferay.portal.impl |
| GHSA-2hm7-r8f3-423h Liferay Portal vulnerable to path traversal and denial-of-service in the ComboServlet | High | Also affects com.liferay.portal:com.liferay.portal.impl |
| GHSA-697h-3q6m-jwp4 Liferay Portal Cross-Site Request Forgery (CSRF) vulnerability | Medium | Also affects com.liferay.portal:com.liferay.portal.impl |
| GHSA-95h4-8mqc-4mpf Liferay Portal has unchecked input for loop condition vulnerability in XML-RPC | High | Also affects com.liferay.portal:com.liferay.portal.impl |
| GHSA-xvgg-9h29-4g34 Liferay Portal has Improper Validation of Specified Quantity in Input | High | Also affects com.liferay.portal:com.liferay.portal.impl |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor