CVE-2025-62258
NoneLiferay Portal Vulnerable to CSRF in Headless APIs
CVSS
—
EPSS
0.2%
Published
Oct 28, 2025
CISA due date
—
The record
CSRF vulnerability in Headless API in Liferay Portal 7.4.0 through 7.4.3.107, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to execute any Headless API via the `endpoint` parameter.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | com.liferay.portal:release.portal.bom | 7.4.0-ga1 | 7.4.3.108 |
| maven | com.liferay.portal/release.portal.bom | 7.4.0-ga1 | 7.4.3.108 |
Related vulnerabilities
- GHSA-gh4w-8qgq-8w9r Liferay Portal Vulnerable to CSRF in Headless APIs Same vulnerability
- CVE-2025-62264 Liferay Portal Vulnerable to Reflected XSS via the selectedLanguageId Parameter Also affects com.liferay.portal:release.portal.bom
- GHSA-56jv-4ww3-65mw Liferay Portal is vulnerable to XSS in the Blogs widget Also affects com.liferay.portal:release.portal.bom
- GHSA-f5vh-4rj2-w8r8 Liferay Portal is vulnerable to DNS rebinding attacks Also affects com.liferay.portal:release.portal.bom
- GHSA-8hw3-ghwv-crfh Liferay Portal vulnerable to password enumeration Also affects com.liferay.portal:release.portal.bom
- CVE-2025-62265 Liferay Portal is vulnerable to XSS in the Blogs widget Also affects com.liferay.portal:release.portal.bom
- CVE-2025-62266 Liferay Portal is vulnerable to DNS rebinding attacks Also affects com.liferay.portal:release.portal.bom
- CVE-2025-62257 Liferay Portal vulnerable to password enumeration Also affects com.liferay.portal:release.portal.bom