---
id: CVE-2025-62241
title: >-
  Insecure Direct Object Reference (IDOR) vulnerability with shipment addresses
  in Liferay DXP 2023.Q4.1 through 2023.Q4.5 allows remote authenticated users
  to from one virtual instance to view the shipment addresses of different
  virtual i…
summary: >-
  Insecure Direct Object Reference (IDOR) vulnerability with shipment addresses
  in Liferay DXP 2023.Q4.1 through 2023.Q4.5 allows remote authenticated users
  to from one virtual instance to view the shipment addresses of different
  virtual i…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-639
vendor: liferay
product: digital_experience_platform
affected:
  - digital_experience_platform = 2023.q4.1
  - digital_experience_platform = 2023.q4.2
  - digital_experience_platform = 2023.q4.3
  - digital_experience_platform = 2023.q4.4
  - digital_experience_platform = 2023.q4.5
published: '2025-10-13'
updated: '2026-10-08'
sourceUpdated: '2026-10-08T12:10:00.217'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-62241'
references:
  - url: >-
      https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62241
    label: security@liferay.com
tags:
  - nvd
epss: 0.00273
epssPercentile: 0.18019
ingestedAt: '2026-10-08T12:39:48.705Z'
---

## Overview

Insecure Direct Object Reference (IDOR) vulnerability with shipment addresses in Liferay DXP 2023.Q4.1 through 2023.Q4.5 allows remote authenticated users to from one virtual instance to view the shipment addresses of different virtual instance via the _com_liferay_commerce_order_web_internal_portlet_CommerceOrderPortlet_commerceOrderId parameter.

## Affected

- `digital_experience_platform = 2023.q4.1`
- `digital_experience_platform = 2023.q4.2`
- `digital_experience_platform = 2023.q4.3`
- `digital_experience_platform = 2023.q4.4`
- `digital_experience_platform = 2023.q4.5`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.