{"id":"CVE-2025-62245","state":"PUBLISHED","title":"Cross-site request forgery (CSRF) vulnerability in Liferay Portal 7.4.1 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA thr","description":"Cross-site request forgery (CSRF) vulnerability in Liferay Portal 7.4.1 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92 allows remote attackers to add and edit publication comments.","publishedAt":"2025-10-10T19:12:11.245Z","updatedAt":"2025-10-13T19:15:58.322Z","severity":{"score":5.1,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","source":"Liferay"},"assigner":"Liferay","products":["Liferay Portal","Liferay DXP"],"affected":[{"vendor":"Liferay","product":"Portal","defaultStatus":"unaffected","versions":[{"version":"7.4.1","status":"affected","lessThanOrEqual":"7.4.3.112","versionType":"maven"}]},{"vendor":"Liferay","product":"DXP","defaultStatus":"unaffected","versions":[{"version":"7.4.13","status":"affected","lessThanOrEqual":"7.4.13-u92","versionType":"maven"},{"version":"2023.Q3.1","status":"affected","lessThanOrEqual":"2023.Q3.10","versionType":"maven"},{"version":"2023.Q4.0","status":"affected","lessThanOrEqual":"2023.Q4.5","versionType":"maven"}]}],"references":["https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62245"],"weaknesses":["CWE-352"],"ingestedAt":"2026-10-29T20:09:48.677Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/62xxx/CVE-2025-62245.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-62245","state":"PUBLISHED","datePublished":"2025-10-10T19:12:11.245Z","dateUpdated":"2025-10-13T19:15:58.322Z","assignerShortName":"Liferay","assignerOrgId":"8b54e794-c6f0-462e-9faa-c1001a673ac3","dateReserved":"2025-10-09T20:58:49.217Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"Cross-site request forgery (CSRF) vulnerability in Liferay Portal 7.4.1 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92 allows remote attackers to add and edit publication comments."}],"affected":[{"vendor":"Liferay","product":"Portal","defaultStatus":"unaffected","versions":[{"version":"7.4.1","status":"affected","lessThanOrEqual":"7.4.3.112","versionType":"maven"}]},{"vendor":"Liferay","product":"DXP","defaultStatus":"unaffected","versions":[{"version":"7.4.13","status":"affected","lessThanOrEqual":"7.4.13-u92","versionType":"maven"},{"version":"2023.Q3.1","status":"affected","lessThanOrEqual":"2023.Q3.10","versionType":"maven"},{"version":"2023.Q4.0","status":"affected","lessThanOrEqual":"2023.Q4.5","versionType":"maven"}]}],"references":[{"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62245"}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":5.1,"baseSeverity":"MEDIUM","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-352","description":"CWE-352 Cross-Site Request Forgery (CSRF)","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"Liferay","orgId":"8b54e794-c6f0-462e-9faa-c1001a673ac3","dateUpdated":"2025-10-13T19:15:58.322Z"},"credits":[{"lang":"en","type":"reporter","value":"foobar7"}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-10-10T20:25:47.094378Z","id":"CVE-2025-62245","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-10-10T20:25:59.228Z"}}]}}}