CVE-2025-62245: CSRF Vulnerability in com.liferay:com.liferay.change.tracking.web Package
Summary
CVE-2025-62245: Liferay Portal is vulnerable to CSRF through publication comments. Affects com.liferay:com.liferay.change.tracking.web versions >= 2.0.9, < 2.0.121. Fixed in 2.0.121. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The com.liferay:com.liferay.change.tracking.web package is part of the Liferay Portal, a popular open-source platform for building web applications and managing content. This package specifically handles change tracking functionalities, allowing users to manage and monitor changes in published content. However, it has been identified to have a vulnerability that exposes it to cross-site request forgery (CSRF) attacks, which can lead to unauthorized actions being performed on behalf of authenticated users.
Vulnerability Detail
The vulnerability arises from inadequate protection against CSRF attacks in Liferay Portal versions 7.4.1 through 7.4.3.112 and Liferay DXP versions 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92. This flaw allows remote attackers to exploit the system by tricking authenticated users into submitting unwanted requests, potentially leading to unauthorized addition and editing of publication comments. The technical aspect of this vulnerability is rooted in the lack of proper validation mechanisms to verify the authenticity of requests.
How To Fix
Minimum fixed version
2.0.121
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, it is advisable to implement additional security measures such as validating the origin of requests and employing anti-CSRF tokens in forms to mitigate the risk of CSRF attacks until the package can be updated.
Conclusion
In summary, the CSRF vulnerability identified as CVE-2025-62245 in the com.liferay:com.liferay.change.tracking.web package poses a moderate risk to users of Liferay Portal and DXP. It is crucial to update to the patched version to safeguard against potential attacks. Additionally, utilizing tools like Vulert can help in monitoring for such vulnerabilities in real-time.
See every vulnerability recorded for com.liferay:com.liferay.change.tracking.web →
FAQ
A CSRF vulnerability allows an attacker to trick a user into executing unwanted actions on a web application in which they are authenticated, potentially compromising their account.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can use the Vulert playground at Vulert Scanner without any signup.
If exploited, this vulnerability can allow attackers to add or edit publication comments without the user's consent, leading to misinformation or unauthorized content being published.
Yes, a patch is available in version 2.0.121 of the com.liferay:com.liferay.change.tracking.web package. Users should update to this version to mitigate the vulnerability.
If an immediate update is not possible, implement additional security measures such as using anti-CSRF tokens and validating request origins to reduce the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.liferay:com.liferay.change.tracking.web.
