{"id":"GHSA-9676-rh83-cr86","summary":"Liferay Portal is vulnerable to CSRF through publication comments","details":"Cross-site request forgery (CSRF) vulnerability in Liferay Portal 7.4.1 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92 allows remote attackers to add and edit publication comments.","aliases":["CVE-2025-62245"],"modified":"2025-10-13T13:57:22.583484Z","published":"2025-10-10T21:31:16Z","database_specific":{"nvd_published_at":"2025-10-10T20:15:39Z","cwe_ids":["CWE-352"],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2025-10-13T13:34:22Z"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-62245"},{"type":"WEB","url":"https://github.com/liferay/liferay-portal/commit/dd89fff675f04d146fda38a1bec884cf40d0c756"},{"type":"WEB","url":"https://github.com/liferay/liferay-portal/commit/fa356d07ab239e790b7e460d33c25184aef58716"},{"type":"PACKAGE","url":"https://github.com/liferay/liferay-portal"},{"type":"WEB","url":"https://liferay.atlassian.net/browse/LPE-17932"},{"type":"WEB","url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62245"}],"affected":[{"package":{"name":"com.liferay:com.liferay.change.tracking.web","ecosystem":"Maven","purl":"pkg:maven/com.liferay/com.liferay.change.tracking.web"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.9"},{"fixed":"2.0.121"}]}],"versions":["2.0.10","2.0.100","2.0.101","2.0.102","2.0.103","2.0.104","2.0.105","2.0.106","2.0.107","2.0.108","2.0.109","2.0.11","2.0.110","2.0.111","2.0.112","2.0.113","2.0.114","2.0.115","2.0.116","2.0.117","2.0.118","2.0.119","2.0.12","2.0.120","2.0.13","2.0.14","2.0.15","2.0.16","2.0.17","2.0.18","2.0.19","2.0.20","2.0.21","2.0.22","2.0.23","2.0.24","2.0.25","2.0.26","2.0.27","2.0.28","2.0.29","2.0.30","2.0.31","2.0.32","2.0.33","2.0.34","2.0.35","2.0.36","2.0.37","2.0.38","2.0.39","2.0.40","2.0.41","2.0.42","2.0.43","2.0.44","2.0.45","2.0.46","2.0.47","2.0.48","2.0.49","2.0.50","2.0.51","2.0.52","2.0.53","2.0.54","2.0.55","2.0.56","2.0.57","2.0.58","2.0.59","2.0.60","2.0.61","2.0.62","2.0.63","2.0.64","2.0.65","2.0.66","2.0.67","2.0.68","2.0.69","2.0.70","2.0.71","2.0.72","2.0.73","2.0.74","2.0.75","2.0.76","2.0.77","2.0.78","2.0.79","2.0.80","2.0.81","2.0.82","2.0.83","2.0.84","2.0.85","2.0.86","2.0.87","2.0.88","2.0.89","2.0.9","2.0.90","2.0.91","2.0.92","2.0.93","2.0.94","2.0.95","2.0.96","2.0.97","2.0.98","2.0.99"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-9676-rh83-cr86/GHSA-9676-rh83-cr86.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"}]}