PT-2025-45723 · Maven · Com.Liferay.Portal:Release.Portal.Bom

Publicado 2025-10-28 · Atualizado 2025-10-28

OSV

CVSS v4.0

7.0

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

CSRF vulnerability in Headless API in Liferay Portal 7.4.0 through 7.4.3.107, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to execute any Headless API via the endpoint parameter.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

GHSA-GH4W-8QGQ-8W9R

Produtos afetados

Com.Liferay.Portal:Release.Portal.Bom

Referências · 4

• https://github.com/liferay/liferay-portal · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-62258 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-gh4w-8qgq-8w9r · Aviso do Fabricante
• https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62258 · Nota