GHSA-gh4w-8qgq-8w9r
NoneCVSS
—
EPSS
—
Published
Oct 28, 2025
CISA due date
—
The record
Liferay Portal Vulnerable to CSRF in Headless APIs
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | com.liferay.portal:release.portal.bom | 7.4.0-ga1 | 7.4.3.108 |
| maven | com.liferay.portal/release.portal.bom | 7.4.0-ga1 | 7.4.3.108 |
Related vulnerabilities
- CVE-2025-62258 Liferay Portal Vulnerable to CSRF in Headless APIs Same vulnerability
- CVE-2025-62264 Liferay Portal Vulnerable to Reflected XSS via the selectedLanguageId Parameter Also affects com.liferay.portal:release.portal.bom
- GHSA-56jv-4ww3-65mw Liferay Portal is vulnerable to XSS in the Blogs widget Also affects com.liferay.portal:release.portal.bom
- GHSA-f5vh-4rj2-w8r8 Liferay Portal is vulnerable to DNS rebinding attacks Also affects com.liferay.portal:release.portal.bom
- GHSA-8hw3-ghwv-crfh Liferay Portal vulnerable to password enumeration Also affects com.liferay.portal:release.portal.bom
- CVE-2025-62265 Liferay Portal is vulnerable to XSS in the Blogs widget Also affects com.liferay.portal:release.portal.bom
- CVE-2025-62266 Liferay Portal is vulnerable to DNS rebinding attacks Also affects com.liferay.portal:release.portal.bom
- CVE-2025-62257 Liferay Portal vulnerable to password enumeration Also affects com.liferay.portal:release.portal.bom