N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-3639

CVE-2025-3639: Liferay Portal Login Bypass Vulnerability

Liferay Portal 7.3.0 through 7.4.3.132, and Liferay DXP 2025.Q1 through 2025.Q1.6, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, 7.4 GA through update 92 and 7.3 GA through update 36 allows unauthenticated users with valid credentials to bypass the login process by changing the POST method to GET, once the site has MFA enabled.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-3639

CVE-2025-3639:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
com.liferay.portal:release.portal.bom	maven	>= 7.3.0-ga1, <= 7.4.3.132-ga132

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability allows an attacker with valid user credentials to bypass the Multi-Factor Authentication (MFA) process by changing the login request's HTTP method from POST to GET. This places the user's password directly into the URL's query string.

The analysis of the provided patches reveals that the core of the fix was to introduce a check that explicitly disallows login attempts if the password parameter is found in the query string. This check was implemented in a new helper function, isPasswordParameterInQueryString, within the AuthenticatedSessionManagerUtil class.

This new security check was then applied in two key locations:

LoginMVCActionCommand.doProcessAction: This is the most direct fix. This class handles the server-side logic for the MFA login portlet. By adding the check here, the primary attack vector described (bypassing MFA) is closed.
AuthenticatedSessionManagerUtil.login: This is a more general, system-wide login function. Patching this function as well serves as a defense-in-depth measure, hardening other potential login paths against the same type of attack, even if they are not directly related to the MFA flow.

Therefore, the identified functions were all part of the vulnerable process. LoginMVCActionCommand.doProcessAction was the entry point for the specific MFA bypass, and AuthenticatedSessionManagerUtil.login was a broader function that also lacked the necessary validation, making it a critical part of the overall fix.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.