Liferay Portal versions 7.3.0 through 7.4.3.132 and Liferay DXP versions 2025.Q1 through 2025.Q1.6, among others, allow unauthenticated users with valid credentials to bypass the login process by changing the POST method to GET when MFA is enabled. This vulnerability poses a risk to user account security and data integrity.
Details
| Severity | Base Score | CVE |
|---|---|---|
| LOW | 2 | CVE-2025-3639 |
Exploitation
To exploit this vulnerability, an attacker with valid credentials can manipulate the HTTP request method from POST to GET, thereby bypassing the login process when Multi-Factor Authentication (MFA) is enabled. This allows unauthorized access to the system without proper authentication.
Affected Products
- Liferay Portal 7.3.0 through 7.4.3.132: A widely used platform for building web applications and portals.
- Liferay DXP 2025.Q1 through 2025.Q1.6: The enterprise version of Liferay Portal, offering additional features and support.
- Various updates of Liferay Portal and DXP: Including multiple versions and updates that are vulnerable to this issue.
Mitigation
To mitigate this vulnerability, it is recommended to update to the latest version of Liferay Portal or DXP that addresses this issue. Additionally, implementing stricter access controls and monitoring for unusual login attempts can help reduce the risk of exploitation.