~ / search / GHSA-gh4w-8qgq-8w9r

GHSA-gh4w-8qgq-8w9r

Liferay Portal Vulnerable to CSRF in Headless APIs

Source: GitHub Advisory Database (reviewed) High CVE-2025-62258

Packages

EcosystemPackageAffectedFixed in
Maven com.liferay.portal:release.portal.bom >= 7.4.0-ga1, < 7.4.3.108 7.4.3.108

Details

As written in the advisory (Markdown source, shown as plain text).

CSRF vulnerability in Headless API in Liferay Portal 7.4.0 through 7.4.3.107, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to execute any Headless API via the `endpoint` parameter.

References

External links from the advisory. They lead to third-party sites.