CVE-2025-62245CWE-352csrf

CVE-2025-62245

Medium · published October 11, 2025

CVSS v3.1
4.3
EPSS
0%
Percentile
8.1
In the wild
Unconfirmed
What it is

Cross-site request forgery (CSRF) vulnerability in Liferay Portal 7.4.1 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92 allows remote attackers to add and edit publication comments.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00189 · 8.1th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2025-10-11T00:15Z
Affected products (4)
ProductVersionsFixed in
liferay/digital_experience_platform≥ 2023.Q3.1, ≤ 2023.Q3.10—
liferay/digital_experience_platform≥ 2023.q4.0, < 2023.q4.62023.q4.6
liferay/digital_experience_platformall versions—
liferay/liferay_portal≥ 7.4.1, < 7.4.3.1137.4.3.113
References (1)
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62245 · [email protected]
EPSS history
Timeline
  • 10 OCT 19:12Z
    Cross-site request forgery (CSRF) vulnerability in Liferay Portal 7.4.1 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through…
    cvelistv5