GHSA-9676-rh83-cr86Medium

Liferay Portal is vulnerable to CSRF through publication comments

Published
October 10, 2025
Last Modified
October 13, 2025

🔗 CVE IDs covered (1)

CVE-2025-62245 →

📋 Description

Cross-site request forgery (CSRF) vulnerability in Liferay Portal 7.4.1 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92 allows remote attackers to add and edit publication comments.

🎯 Affected products1

  • maven/com.liferay:com.liferay.change.tracking.web:>= 2.0.9, < 2.0.121

🔗 References (6)