GitHub Advisoryadvisory · Maven

GHSA-9676-rh83-cr86 Liferay Portal is vulnerable to CSRF through publication comments

MEDIUM Published 2025-10-10 Modified 2025-10-13 Official page ↗
Aliases
CVE-2025-62245
Ecosystem
Maven
Packages
com.liferay:com.liferay.change.tracking.web
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-352
Reviewed
2025-10-13

Affected packages

• Maven com.liferay:com.liferay.change.tracking.web: >= 2.0.9, < 2.0.121 → fixed in 2.0.121

Description

Cross-site request forgery (CSRF) vulnerability in Liferay Portal 7.4.1 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92 allows remote attackers to add and edit publication comments.

Related

Alias · CVE (1)

  • CVE-2025-62245 Cross-site request forgery (CSRF) vulnerability in Liferay Portal 7.4.1 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.5,… vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References