CVE-2025-62243: Liferay Change Tracking Web Package Vulnerable to Incorrect Authorization
Summary
CVE-2025-62243: Liferay Publications is vulnerable to Incorrect Authorization. Affects com.liferay:com.liferay.change.tracking.web versions < 2.0.122. Fixed in 2.0.122. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Liferay Change Tracking Web package is part of the Liferay Portal, a popular open-source platform for building web applications. This package facilitates the management of change tracking in publications, allowing users to view and manage publication comments. However, it has been identified that certain versions of this package are susceptible to an insecure direct object reference (IDOR) vulnerability, which can lead to unauthorized access to sensitive information.
Vulnerability Detail
The vulnerability arises from improper permission checks in the Publications feature of Liferay Portal versions 7.4.1 through 7.4.3.112 and Liferay DXP versions 2023.Q4.0 through 2023.Q4.5, among others. This flaw allows remote authenticated attackers to view and edit publication comments by manipulating the '_com_liferay_change_tracking_web_portlet_PublicationsPortlet_value' parameter in crafted URLs. The ramifications include potential exposure of sensitive comments and unauthorized modifications, compromising the integrity of the publication system.
How To Fix
Minimum fixed version
2.0.122
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict access to the Publications feature for users who do not require it. This can be done by adjusting user roles and permissions within the Liferay Portal settings until the package is updated.
Conclusion
The Liferay Change Tracking Web package is vulnerable to an IDOR vulnerability that can lead to unauthorized access to publication comments. It is crucial to update to the patched version 2.0.122 or later to mitigate this risk. Users are encouraged to monitor their applications for vulnerabilities using tools like Vulert.
See every vulnerability recorded for com.liferay:com.liferay.change.tracking.web →
FAQ
CVE-2025-62243 is a vulnerability in the Liferay Change Tracking Web package that allows unauthorized access to publication comments due to improper permission checks.
The affected versions include Liferay Portal 7.4.1 through 7.4.3.112 and Liferay DXP 2023.Q4.0 through 2023.Q4.5, among others.
You can use Vulert, which monitors open-source vulnerabilities in your software by analyzing the 'pom.xml' file. Visit Vulert Scanner to check your application without needing to sign up.
The risks include unauthorized viewing and editing of publication comments, which can compromise the integrity and confidentiality of sensitive information.
If immediate updating is not possible, consider restricting access to the affected features and monitoring user permissions closely until the update can be applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.liferay:com.liferay.change.tracking.web.
