-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJavaMiggo AIRoot Cause AnalysisThe analysis of the provided patches reveals that the password enumeration vulnerability (CVE-2025-62257) is located in the _authenticate method of the com.liferay.portal.security.auth.session.AuthenticatedSessionManagerImpl class. The key evidence is found in commit 45cffd5030ab78e8b005d9cfd6284311da978c68. The patch removes a block of code that, in the case of a failed authentication, would proceed to fetch the user and check for account lockout. This differential behavior is the root cause of the vulnerability, as it allows an attacker to infer information about user accounts. The fix ensures that all authentication failures result in a uniform AuthException, eliminating the information leak. The other commits (924a0a47007665693fe2d29623cb48a426a80266 and d21627ac07561c5063f611be631e63ff502ec8e7) are related to adding and modifying integration tests to verify the fix and do not contain vulnerable production code.
com.liferay.portal.security.auth.session.AuthenticatedSessionManagerImpl._authenticateportal-impl/src/com/liferay/portal/security/auth/session/AuthenticatedSessionManagerImpl.java
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| com.liferay.portal:release.portal.bom | maven | >= 7.4.0-ga1, < 7.4.3.120 | 7.4.3.120 |
Ongoing coverage of React2Shell