VYPR
Get started
← All advisories
Moderate severityNVD Advisory· Published Oct 10, 2025· Updated Oct 13, 2025

CVE-2025-62245

CVE-2025-62245

Description

Cross-site request forgery (CSRF) vulnerability in Liferay Portal 7.4.1 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92 allows remote attackers to add and edit publication comments.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
com.liferay:com.liferay.change.tracking.webMaven
>= 2.0.9, < 2.0.1212.0.121

Affected products

2

Patches

2
fa356d07ab23

LPD-15347 ensure user has permissions to add/update comments

https://github.com/liferay/liferay-portalDavid TruongFeb 14, 2024via ghsa
commit
2 files changed · +47 −2
  • modules/apps/change-tracking/change-tracking-web/src/main/java/com/liferay/change/tracking/web/internal/portlet/action/UpdateCTCommentMVCResourceCommand.java+23 −2 modified
    @@ -11,12 +11,17 @@
 import com.liferay.portal.kernel.json.JSONObject;
 import com.liferay.portal.kernel.json.JSONUtil;
 import com.liferay.portal.kernel.language.Language;
+import com.liferay.portal.kernel.log.Log;
+import com.liferay.portal.kernel.log.LogFactoryUtil;
 import com.liferay.portal.kernel.portlet.JSONPortletResponseUtil;
 import com.liferay.portal.kernel.portlet.bridges.mvc.MVCResourceCommand;
+import com.liferay.portal.kernel.security.auth.AuthTokenUtil;
+import com.liferay.portal.kernel.security.auth.PrincipalException;
 import com.liferay.portal.kernel.security.permission.ActionKeys;
 import com.liferay.portal.kernel.servlet.HttpMethods;
 import com.liferay.portal.kernel.theme.ThemeDisplay;
 import com.liferay.portal.kernel.util.ParamUtil;
+import com.liferay.portal.kernel.util.Portal;
 import com.liferay.portal.kernel.util.StringUtil;
 import com.liferay.portal.kernel.util.WebKeys;
 
@@ -54,9 +59,19 @@ protected void doServeResource(
 		long ctCollectionId = ParamUtil.getLong(
 			resourceRequest, "ctCollectionId");
 
-		if (!CTCollectionPermission.contains(
+		try {
+			AuthTokenUtil.checkCSRFToken(
+				_portal.getHttpServletRequest(resourceRequest),
+				UpdateCTCommentMVCResourceCommand.class.getName());
+
+			CTCollectionPermission.check(
 				themeDisplay.getPermissionChecker(), ctCollectionId,
-				ActionKeys.VIEW)) {
+				ActionKeys.VIEW);
+		}
+		catch (PrincipalException principalException) {
+			if (_log.isWarnEnabled()) {
+				_log.warn(principalException);
+			}
 
 			JSONPortletResponseUtil.writeJSON(
 				resourceRequest, resourceResponse,
@@ -110,7 +125,13 @@ protected void doServeResource(
 			resourceRequest, resourceResponse, jsonObject);
 	}
 
+	private static final Log _log = LogFactoryUtil.getLog(
+		UpdateCTCommentMVCResourceCommand.class);
+
 	@Reference
 	private Language _language;
 
+	@Reference
+	private Portal _portal;
+
 }
\ No newline at end of file
  • modules/apps/change-tracking/change-tracking-web/src/main/java/com/liferay/change/tracking/web/internal/security/permission/resource/CTCollectionPermission.java+24 −0 modified
    @@ -16,6 +16,30 @@
  */
 public class CTCollectionPermission {
 
+	public static void check(
+			PermissionChecker permissionChecker, CTCollection ctCollection,
+			String actionId)
+		throws PortalException {
+
+		ModelResourcePermission<CTCollection> modelResourcePermission =
+			_ctCollectionModelResourcePermissionSnapshot.get();
+
+		modelResourcePermission.check(
+			permissionChecker, ctCollection, actionId);
+	}
+
+	public static void check(
+			PermissionChecker permissionChecker, long ctCollectionId,
+			String actionId)
+		throws PortalException {
+
+		ModelResourcePermission<CTCollection> modelResourcePermission =
+			_ctCollectionModelResourcePermissionSnapshot.get();
+
+		modelResourcePermission.check(
+			permissionChecker, ctCollectionId, actionId);
+	}
+
 	public static boolean contains(
 			PermissionChecker permissionChecker, CTCollection ctCollection,
 			String actionId)
dd89fff675f0

LPD-15347 ensure request is a post

https://github.com/liferay/liferay-portalDavid TruongFeb 14, 2024via ghsa
commit
2 files changed · +18 −4
  • modules/apps/change-tracking/change-tracking-web/src/main/java/com/liferay/change/tracking/web/internal/portlet/action/UpdateCTCommentMVCResourceCommand.java+6 −0 modified
    @@ -14,8 +14,10 @@
 import com.liferay.portal.kernel.portlet.JSONPortletResponseUtil;
 import com.liferay.portal.kernel.portlet.bridges.mvc.MVCResourceCommand;
 import com.liferay.portal.kernel.security.permission.ActionKeys;
+import com.liferay.portal.kernel.servlet.HttpMethods;
 import com.liferay.portal.kernel.theme.ThemeDisplay;
 import com.liferay.portal.kernel.util.ParamUtil;
+import com.liferay.portal.kernel.util.StringUtil;
 import com.liferay.portal.kernel.util.WebKeys;
 
 import javax.portlet.ResourceRequest;
@@ -42,6 +44,10 @@ protected void doServeResource(
 			ResourceRequest resourceRequest, ResourceResponse resourceResponse)
 		throws Exception {
 
+		if (!StringUtil.equals(resourceRequest.getMethod(), HttpMethods.POST)) {
+			return;
+		}
+
 		ThemeDisplay themeDisplay = (ThemeDisplay)resourceRequest.getAttribute(
 			WebKeys.THEME_DISPLAY);
  • modules/apps/change-tracking/change-tracking-web/src/main/resources/META-INF/resources/publications/js/components/ChangeTrackingComments.js+12 −4 modified
    @@ -99,7 +99,9 @@ export default function ChangeTrackingComments({
 			ctEntryId,
 		});
 
-		fetch(portletURL)
+		fetch(portletURL, {
+			method: 'post',
+		})
 			.then((response) => response.json())
 			.then((json) => {
 				if (!json.comments) {
@@ -135,7 +137,9 @@ export default function ChangeTrackingComments({
 			ctEntryId,
 		});
 
-		fetch(portletURL)
+		fetch(portletURL, {
+			method: 'post',
+		})
 			.then((response) => response.json())
 			.then((json) => {
 				if (!json.comments) {
@@ -169,7 +173,9 @@ export default function ChangeTrackingComments({
 			value: inputValue,
 		});
 
-		fetch(portletURL.toString())
+		fetch(portletURL.toString(), {
+			method: 'post',
+		})
 			.then((response) => response.json())
 			.then((json) => {
 				setDeleting(0);
@@ -211,7 +217,9 @@ export default function ChangeTrackingComments({
 			value: newValue,
 		});
 
-		fetch(portletURL)
+		fetch(portletURL, {
+			method: 'post',
+		})
 			.then((response) => response.json())
 			.then((json) => {
 				setDeleting(0);

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

6

News mentions

0

No linked articles in our index yet.