GHSA-3j6h-5v68-hvqg

ghsaUSosv

Liferay Portal CAPTCHA Bypass for Gogo Shell

view advisory published 2025-08-05Licence: CC-BY-4.0

The vulnerable code can bypass the Captcha check in Liferay Portal 7.4.3.80 through 7.4.3.132, and Liferay DXP 2024.Q1.1 through 2024.Q1.19, 2024.Q2.0 through 2024.Q2.13, 2024.Q3.0 through 2024.Q3.13, 2024.Q4.0 through 2024.Q4.7, 2025.Q1.0 through 2025.Q1.15 and 7.4 update 80 through update 92 and then attackers can run scripts in the Gogo shell.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2025-4604US	medium6.1	0.17% (7th)	—	2025-08-04
The vulnerable code can bypass the Captcha check in Liferay Portal 7.4.3.80 through 7.4.3.132, and Liferay DXP 2024.Q1.1 through 2024.Q1.19, 2024.Q2.0 through 2024.Q2.13, 2024.Q3.0…

references

External citations — patches, advisories, analysis.

https://github.com/liferay/liferay-portalPACKAGE
https://liferay.atlassian.net/browse/LPE-18168WEB
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-4604WEB
https://nvd.nist.gov/vuln/detail/CVE-2025-4604ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan