-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe analysis of CVE-2025-62275 indicates an improper access control vulnerability where images within blog entries can be viewed without correct permissions. The provided patches address an issue where attachments could be uploaded to a blog entry even when a workflow was active, which should have prevented such an action. The reasoning connects these two issues by hypothesizing that bypassing the workflow during the upload process is the root cause of the improper permissions on the images. When the workflow is bypassed, the images are likely created without the necessary access restrictions, making them publicly viewable via a direct URL. The patch corrects this by introducing the showDragAndDropZone method, which enforces the workflow check before allowing an upload. Therefore, this function is identified as the critical component of the fix, and its absence represents the vulnerability. The confidence is rated as medium because the provided commit messages reference different internal issue trackers than the CVE, suggesting a potential mismatch, though the code changes are in the correct module and address a plausible root cause.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| com.liferay:com.liferay.blogs.item.selector.web | maven | < 6.0.19 | 6.0.19 |