CVE-2025-62258

Published: Oct 27, 2025Modified: Jun 17, 2026

7.0

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: security@liferay.com (Secondary)

Description

CSRF vulnerability in Headless API in Liferay Portal 7.4.0 through 7.4.3.107, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to execute any Headless API via the `endpoint` parameter.

Affected (47)

Products: Liferay: Digital Experience Platform, Liferay Portal

Liferay

2 products

Digital Experience Platform

Liferay Portal

Configuration A

47 vulnerable

Vulnerable Software	Affected Versions
Liferay Digital Experience Platform	Version 2023.q3.1
Liferay Digital Experience Platform	Version 2023.q3.2
Liferay Digital Experience Platform	Version 2023.q3.3
Liferay Digital Experience Platform	Version 2023.q3.4
Liferay Digital Experience Platform	Version 7.3
Liferay Digital Experience Platform	Version 7.3 fix_pack_1
Liferay Digital Experience Platform	Version 7.3 fix_pack_2
Liferay Digital Experience Platform	Version 7.3 service_pack_1
Liferay Digital Experience Platform	Version 7.3 service_pack_2
Liferay Digital Experience Platform	Version 7.3 service_pack_3
Liferay Digital Experience Platform	Version 7.3 update10
Liferay Digital Experience Platform	Version 7.3 update11
Liferay Digital Experience Platform	Version 7.3 update12
Liferay Digital Experience Platform	Version 7.3 update13
Liferay Digital Experience Platform	Version 7.3 update14
Liferay Digital Experience Platform	Version 7.3 update15
Liferay Digital Experience Platform	Version 7.3 update16
Liferay Digital Experience Platform	Version 7.3 update17
Liferay Digital Experience Platform	Version 7.3 update18
Liferay Digital Experience Platform	Version 7.3 update19
Liferay Digital Experience Platform	Version 7.3 update1
Liferay Digital Experience Platform	Version 7.3 update20
Liferay Digital Experience Platform	Version 7.3 update21
Liferay Digital Experience Platform	Version 7.3 update22
Liferay Digital Experience Platform	Version 7.3 update23
Liferay Digital Experience Platform	Version 7.3 update24
Liferay Digital Experience Platform	Version 7.3 update25
Liferay Digital Experience Platform	Version 7.3 update26
Liferay Digital Experience Platform	Version 7.3 update27
Liferay Digital Experience Platform	Version 7.3 update28
Liferay Digital Experience Platform	Version 7.3 update29
Liferay Digital Experience Platform	Version 7.3 update2
Liferay Digital Experience Platform	Version 7.3 update30
Liferay Digital Experience Platform	Version 7.3 update31
Liferay Digital Experience Platform	Version 7.3 update32
Liferay Digital Experience Platform	Version 7.3 update33
Liferay Digital Experience Platform	Version 7.3 update34
Liferay Digital Experience Platform	Version 7.3 update35
Liferay Digital Experience Platform	Version 7.3 update3
Liferay Digital Experience Platform	Version 7.3 update4
Liferay Digital Experience Platform	Version 7.3 update5
Liferay Digital Experience Platform	Version 7.3 update6
Liferay Digital Experience Platform	Version 7.3 update7
Liferay Digital Experience Platform	Version 7.3 update8
Liferay Digital Experience Platform	Version 7.3 update9
Liferay Digital Experience Platform	Version 7.4
Liferay Liferay Portal	From 7.4.0 to 7.4.3.108

Related CWEs

CWE-352

Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

References (1)

https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62258

Source: security@liferay.com

Vendor Advisory

Timeline

No history available yet.