What’s Vulnerable › Vulnerabilities
CVE-2025-3602
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-06-16 · updated 2026-06-17
- Weakness: CWE-400
Description
Liferay Portal 7.4.0 through 7.4.3.97, and Liferay DXP 2023.Q3.1 through 2023.Q3.2, 7.4 GA through update 92, 7.3 GA through update 35, and 7.2 fix pack 8 through fix pack 20 does not limit the depth of a GraphQL queries, which allows remote attackers to perform denial-of-service (DoS) attacks on the application by executing complex queries.
Affected products
- Liferay Digital Experience Platform: from 2023.q3.1 through 2023.q3.2; 7.2-fix_pack_10, 7.2-fix_pack_11, 7.2-fix_pack_12, 7.2-fix_pack_13, 7.2-fix_pack_14, 7.2-fix_pack_15 (+49)
- Liferay Portal: from 7.4.0 through 7.4.3.97
References
Get alerted when CVE-2025-3602 or the next vulnerability affects your stack