GHSA-gh4w-8qgq-8w9r

ghsaUSosv

Liferay Portal Vulnerable to CSRF in Headless APIs

view advisory published 2025-10-28Licence: CC-BY-4.0

CSRF vulnerability in Headless API in Liferay Portal 7.4.0 through 7.4.3.107, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to execute any Headless API via the `endpoint` parameter.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2025-62258US	medium6.5	0.18% (8th)	—	2025-10-27
CSRF vulnerability in Headless API in Liferay Portal 7.4.0 through 7.4.3.107, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and o…

references

External citations — patches, advisories, analysis.

https://github.com/liferay/liferay-portalPACKAGE
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62258WEB
https://nvd.nist.gov/vuln/detail/CVE-2025-62258ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan