CVE-2025-62258: CSRF

Published Oct 27, 2025
·
Updated

CSRF vulnerability in Headless API in Liferay Portal 7.4.0 through 7.4.3.107, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to execute any Headless API via the endpoint parameter.

Affected Software

50 affected componentsFixes available
Liferay portal>=7.4.0<=7.4.3.107, >=7.4 GA<=7.4 GA update 92, >=7.3 GA<=7.3 GA update 35
Liferay DXP>=2023.Q3.1<=2023.Q3.4
maven/com.liferay.portal:release.portal.bom>=7.4.0-ga1<7.4.3.108
7.4.3.108
Liferay Digital Experience Platform=7.3
Liferay Digital Experience Platform=7.3-fix_pack_1
Liferay Digital Experience Platform=7.3-fix_pack_2
Liferay Digital Experience Platform=7.3-service_pack_1
Liferay Digital Experience Platform=7.3-service_pack_2
Liferay Digital Experience Platform=7.3-service_pack_3
Liferay Digital Experience Platform=7.3-update1
Liferay Digital Experience Platform=7.3-update10
Liferay Digital Experience Platform=7.3-update11
Liferay Digital Experience Platform=7.3-update12
Liferay Digital Experience Platform=7.3-update13
Liferay Digital Experience Platform=7.3-update14
Liferay Digital Experience Platform=7.3-update15
Liferay Digital Experience Platform=7.3-update16
Liferay Digital Experience Platform=7.3-update17
Liferay Digital Experience Platform=7.3-update18
Liferay Digital Experience Platform=7.3-update19
Liferay Digital Experience Platform=7.3-update2
Liferay Digital Experience Platform=7.3-update20
Liferay Digital Experience Platform=7.3-update21
Liferay Digital Experience Platform=7.3-update22
Liferay Digital Experience Platform=7.3-update23
Liferay Digital Experience Platform=7.3-update24
Liferay Digital Experience Platform=7.3-update25
Liferay Digital Experience Platform=7.3-update26
Liferay Digital Experience Platform=7.3-update27
Liferay Digital Experience Platform=7.3-update28
Liferay Digital Experience Platform=7.3-update29
Liferay Digital Experience Platform=7.3-update3
Liferay Digital Experience Platform=7.3-update30
Liferay Digital Experience Platform=7.3-update31
Liferay Digital Experience Platform=7.3-update32
Liferay Digital Experience Platform=7.3-update33
Liferay Digital Experience Platform=7.3-update34
Liferay Digital Experience Platform=7.3-update35
Liferay Digital Experience Platform=7.3-update4
Liferay Digital Experience Platform=7.3-update5
Liferay Digital Experience Platform=7.3-update6
Liferay Digital Experience Platform=7.3-update7
Liferay Digital Experience Platform=7.3-update8
Liferay Digital Experience Platform=7.3-update9
Liferay Digital Experience Platform=7.4
Liferay Digital Experience Platform=2023.q3.1
Liferay Digital Experience Platform=2023.q3.2
Liferay Digital Experience Platform=2023.q3.3
Liferay Digital Experience Platform=2023.q3.4
Liferay Liferay Portal>=7.4.0<7.4.3.108

Event History

Oct 27, 2025
CVE Published
via MITRE·10:56 PM
Data Sourced
via MITRE·10:56 PM
DescriptionWeakness
Data Sourced
via NVD·11:15 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·11:15 PM
Affected Software
Oct 28, 2025
Advisory Published
via GitHub·12:31 AM
Data Sourced
via GitHub·12:31 AM
DescriptionWeaknessAffected Software
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2025-62258?

CVE-2025-62258 is a critical cross-site request forgery (CSRF) vulnerability that allows remote attackers to execute any Headless API.

2

How do I fix CVE-2025-62258?

To mitigate CVE-2025-62258, upgrade to the latest patched version of Liferay Portal or Liferay DXP as specified in the security advisory.

3

Which versions are affected by CVE-2025-62258?

CVE-2025-62258 affects Liferay Portal versions 7.4.0 to 7.4.3.107, Liferay DXP versions 2023.Q3.1 to 2023.Q3.4, and several older unsupported versions.

4

What impact does CVE-2025-62258 have on my application?

CVE-2025-62258 allows attackers to perform unauthorized actions on behalf of users via the Headless API, potentially leading to data exposure or manipulation.

5

Is CVE-2025-62258 being actively exploited?

While specific exploitation details are not publicly documented, the nature of CSRF vulnerabilities raises a high risk of active exploitation in vulnerable systems.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203