Vulnerability · Published Jun 16, 2025 · Assigned by Liferay

CVE-2025-3602

High 8.7

In plain English

A high-severity uncontrolled resource consumption in DXP from Liferay. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)8.7High

Exploit odds (30 days)0.5%top 55.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Liferay Portal 7.4.0 through 7.4.3.97, and Liferay DXP 2023.Q3.1 through 2023.Q3.2, 7.4 GA through update 92, 7.3 GA through update 35, and 7.2 fix pack 8 through fix pack 20 does not limit the depth of a GraphQL queries, which allows remote attackers to perform denial-of-service (DoS) attacks on the application by executing complex queries.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	com.liferay:com.liferay.portal.vulcan.impl	5.0.103	GHSA-8c26-xm99-53w7

Affected products (as reported)

Vendor	Product	Versions
Liferay	Portal	7.4.0 – through 7.4.3.97
Liferay	DXP	7.2.10-dxp-8 – through dxp-207.3.10 – through 7.3.10-u357.4.13 – through 7.4.13-u922023.Q3.1 – through 2023.Q3.2

Weakness: CWE-400 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-3602