VYPR
Get started
← All advisories
Moderate severityNVD Advisory· Published Oct 13, 2025· Updated Oct 14, 2025

CVE-2025-62242

CVE-2025-62242

Description

Insecure Direct Object Reference (IDOR) vulnerability with account addresses in Liferay Portal 7.4.3.4 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92 allows remote authenticated users to from one account to view addresses from a different account via the _com_liferay_account_admin_web_internal_portlet_AccountEntriesAdminPortlet_addressId parameter.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
com.liferay:com.liferay.change.tracking.webMaven
< 2.0.1202.0.120

Affected products

2

Patches

2
fa356d07ab23

LPD-15347 ensure user has permissions to add/update comments

https://github.com/liferay/liferay-portalDavid TruongFeb 14, 2024via ghsa
commit
2 files changed · +47 −2
  • modules/apps/change-tracking/change-tracking-web/src/main/java/com/liferay/change/tracking/web/internal/portlet/action/UpdateCTCommentMVCResourceCommand.java+23 −2 modified
    @@ -11,12 +11,17 @@
 import com.liferay.portal.kernel.json.JSONObject;
 import com.liferay.portal.kernel.json.JSONUtil;
 import com.liferay.portal.kernel.language.Language;
+import com.liferay.portal.kernel.log.Log;
+import com.liferay.portal.kernel.log.LogFactoryUtil;
 import com.liferay.portal.kernel.portlet.JSONPortletResponseUtil;
 import com.liferay.portal.kernel.portlet.bridges.mvc.MVCResourceCommand;
+import com.liferay.portal.kernel.security.auth.AuthTokenUtil;
+import com.liferay.portal.kernel.security.auth.PrincipalException;
 import com.liferay.portal.kernel.security.permission.ActionKeys;
 import com.liferay.portal.kernel.servlet.HttpMethods;
 import com.liferay.portal.kernel.theme.ThemeDisplay;
 import com.liferay.portal.kernel.util.ParamUtil;
+import com.liferay.portal.kernel.util.Portal;
 import com.liferay.portal.kernel.util.StringUtil;
 import com.liferay.portal.kernel.util.WebKeys;
 
@@ -54,9 +59,19 @@ protected void doServeResource(
 		long ctCollectionId = ParamUtil.getLong(
 			resourceRequest, "ctCollectionId");
 
-		if (!CTCollectionPermission.contains(
+		try {
+			AuthTokenUtil.checkCSRFToken(
+				_portal.getHttpServletRequest(resourceRequest),
+				UpdateCTCommentMVCResourceCommand.class.getName());
+
+			CTCollectionPermission.check(
 				themeDisplay.getPermissionChecker(), ctCollectionId,
-				ActionKeys.VIEW)) {
+				ActionKeys.VIEW);
+		}
+		catch (PrincipalException principalException) {
+			if (_log.isWarnEnabled()) {
+				_log.warn(principalException);
+			}
 
 			JSONPortletResponseUtil.writeJSON(
 				resourceRequest, resourceResponse,
@@ -110,7 +125,13 @@ protected void doServeResource(
 			resourceRequest, resourceResponse, jsonObject);
 	}
 
+	private static final Log _log = LogFactoryUtil.getLog(
+		UpdateCTCommentMVCResourceCommand.class);
+
 	@Reference
 	private Language _language;
 
+	@Reference
+	private Portal _portal;
+
 }
\ No newline at end of file
  • modules/apps/change-tracking/change-tracking-web/src/main/java/com/liferay/change/tracking/web/internal/security/permission/resource/CTCollectionPermission.java+24 −0 modified
    @@ -16,6 +16,30 @@
  */
 public class CTCollectionPermission {
 
+	public static void check(
+			PermissionChecker permissionChecker, CTCollection ctCollection,
+			String actionId)
+		throws PortalException {
+
+		ModelResourcePermission<CTCollection> modelResourcePermission =
+			_ctCollectionModelResourcePermissionSnapshot.get();
+
+		modelResourcePermission.check(
+			permissionChecker, ctCollection, actionId);
+	}
+
+	public static void check(
+			PermissionChecker permissionChecker, long ctCollectionId,
+			String actionId)
+		throws PortalException {
+
+		ModelResourcePermission<CTCollection> modelResourcePermission =
+			_ctCollectionModelResourcePermissionSnapshot.get();
+
+		modelResourcePermission.check(
+			permissionChecker, ctCollectionId, actionId);
+	}
+
 	public static boolean contains(
 			PermissionChecker permissionChecker, CTCollection ctCollection,
 			String actionId)
dd89fff675f0

LPD-15347 ensure request is a post

https://github.com/liferay/liferay-portalDavid TruongFeb 14, 2024via ghsa
commit
2 files changed · +18 −4
  • modules/apps/change-tracking/change-tracking-web/src/main/java/com/liferay/change/tracking/web/internal/portlet/action/UpdateCTCommentMVCResourceCommand.java+6 −0 modified
    @@ -14,8 +14,10 @@
 import com.liferay.portal.kernel.portlet.JSONPortletResponseUtil;
 import com.liferay.portal.kernel.portlet.bridges.mvc.MVCResourceCommand;
 import com.liferay.portal.kernel.security.permission.ActionKeys;
+import com.liferay.portal.kernel.servlet.HttpMethods;
 import com.liferay.portal.kernel.theme.ThemeDisplay;
 import com.liferay.portal.kernel.util.ParamUtil;
+import com.liferay.portal.kernel.util.StringUtil;
 import com.liferay.portal.kernel.util.WebKeys;
 
 import javax.portlet.ResourceRequest;
@@ -42,6 +44,10 @@ protected void doServeResource(
 			ResourceRequest resourceRequest, ResourceResponse resourceResponse)
 		throws Exception {
 
+		if (!StringUtil.equals(resourceRequest.getMethod(), HttpMethods.POST)) {
+			return;
+		}
+
 		ThemeDisplay themeDisplay = (ThemeDisplay)resourceRequest.getAttribute(
 			WebKeys.THEME_DISPLAY);
  • modules/apps/change-tracking/change-tracking-web/src/main/resources/META-INF/resources/publications/js/components/ChangeTrackingComments.js+12 −4 modified
    @@ -99,7 +99,9 @@ export default function ChangeTrackingComments({
 			ctEntryId,
 		});
 
-		fetch(portletURL)
+		fetch(portletURL, {
+			method: 'post',
+		})
 			.then((response) => response.json())
 			.then((json) => {
 				if (!json.comments) {
@@ -135,7 +137,9 @@ export default function ChangeTrackingComments({
 			ctEntryId,
 		});
 
-		fetch(portletURL)
+		fetch(portletURL, {
+			method: 'post',
+		})
 			.then((response) => response.json())
 			.then((json) => {
 				if (!json.comments) {
@@ -169,7 +173,9 @@ export default function ChangeTrackingComments({
 			value: inputValue,
 		});
 
-		fetch(portletURL.toString())
+		fetch(portletURL.toString(), {
+			method: 'post',
+		})
 			.then((response) => response.json())
 			.then((json) => {
 				setDeleting(0);
@@ -211,7 +217,9 @@ export default function ChangeTrackingComments({
 			value: newValue,
 		});
 
-		fetch(portletURL)
+		fetch(portletURL, {
+			method: 'post',
+		})
 			.then((response) => response.json())
 			.then((json) => {
 				setDeleting(0);

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

6

News mentions

0

No linked articles in our index yet.