CVE-2025-62245

CWE-352 — Cross-Site Request Forgery (CSRF)4 documents4 sources
Severity
5.1MEDIUM
EPSS
0.0%
top 99.55%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Liferay Digital Experience PlatformLiferay Liferay PortalLiferay DXP+1 more
Timeline
PublishedOct 10

Description

Cross-site request forgery (CSRF) vulnerability in Liferay Portal 7.4.1 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92 allows remote attackers to add and edit publication comments.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Affected Packages5 packages

▶NVDliferay/liferay_portal7.4.1 — 7.4.3.113
▶CVEListV5liferay/portal7.4.1 — 7.4.3.112
▶NVDliferay/digital_experience_platform2023.q4.0 — 2023.q4.6+2
▶CVEListV5liferay/dxp7.4.13 — 7.4.13-u92+2

🔴Vulnerability Details

3
GHSA
Liferay Portal is vulnerable to CSRF through publication comments↗2025-10-10
▶
OSV
Liferay Portal is vulnerable to CSRF through publication comments↗2025-10-10
▶
CVEList
CVE-2025-62245: Cross-site request forgery (CSRF) vulnerability in Liferay Portal 7↗2025-10-10
▶
CVE-2025-62245 (MEDIUM CVSS 5.1) | Cross-site request forgery (CSRF) v | cvebase.io