CVE-2025-62243

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-62243", "assignerOrgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3", "state": "PUBLISHED", "assignerShortName": "Liferay", "dateReserved": "2025-10-09T20:58:49.217Z", "datePublished": "2025-10-13T17:14:58.696Z", "dateUpdated": "2025-10-14T15:06:31.612Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Portal", "vendor": "Liferay", "versions": [{"lessThanOrEqual": "7.4.3.112", "status": "affected", "version": "7.4.1", "versionType": "maven"}]}, {"defaultStatus": "unaffected", "product": "DXP", "vendor": "Liferay", "versions": [{"lessThanOrEqual": "7.4.13-u92", "status": "affected", "version": "7.4.13", "versionType": "maven"}, {"lessThanOrEqual": "2023.Q3.8", "status": "affected", "version": "2023.Q3.1", "versionType": "maven"}, {"lessThanOrEqual": "2023.Q4.5", "status": "affected", "version": "2023.Q4.0", "versionType": "maven"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "foobar7"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Insecure direct object reference (IDOR) vulnerability in Publications in Liferay Portal 7.4.1 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92 allows remote authenticated attackers to view publication comments via the _com_liferay_change_tracking_web_portlet_PublicationsPortlet_value parameter.<br><br>Publications comments in Liferay Portal 7.4.1 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92 does not properly check user permissions, which allows remote authenticated users to edit publication comments via crafted URLs."}], "value": "Insecure direct object reference (IDOR) vulnerability in Publications in Liferay Portal 7.4.1 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92 allows remote authenticated attackers to view publication comments via the _com_liferay_change_tracking_web_portlet_PublicationsPortlet_value parameter.\n\nPublications comments in Liferay Portal 7.4.1 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92 does not properly check user permissions, which allows remote authenticated users to edit publication comments via crafted URLs."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 5.3, "baseSeverity": "MEDIUM", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3", "shortName": "Liferay", "dateUpdated": "2025-10-13T17:14:58.696Z"}, "references": [{"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62243"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-14T15:06:20.225891Z", "id": "CVE-2025-62243", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-14T15:06:31.612Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "reporter", "value": "foobar7"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Liferay", "product": "Portal", "versions": [{"status": "affected", "version": "7.4.1", "versionType": "maven", "lessThanOrEqual": "7.4.3.112"}], "defaultStatus": "unaffected"}, {"vendor": "Liferay", "product": "DXP", "versions": [{"status": "affected", "version": "7.4.13", "versionType": "maven", "lessThanOrEqual": "7.4.13-u92"}, {"status": "affected", "version": "2023.Q3.1", "versionType": "maven", "lessThanOrEqual": "2023.Q3.8"}, {"status": "affected", "version": "2023.Q4.0", "versionType": "maven", "lessThanOrEqual": "2023.Q4.5"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62243"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Insecure direct object reference (IDOR) vulnerability in Publications in Liferay Portal 7.4.1 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92 allows remote authenticated attackers to view publication comments via the _com_liferay_change_tracking_web_portlet_PublicationsPortlet_value parameter.\n\nPublications comments in Liferay Portal 7.4.1 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92 does not properly check user permissions, which allows remote authenticated users to edit publication comments via crafted URLs.", "supportingMedia": [{"type": "text/html", "value": "Insecure direct object reference (IDOR) vulnerability in Publications in Liferay Portal 7.4.1 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92 allows remote authenticated attackers to view publication comments via the _com_liferay_change_tracking_web_portlet_PublicationsPortlet_value parameter.<br><br>Publications comments in Liferay Portal 7.4.1 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92 does not properly check user permissions, which allows remote authenticated users to edit publication comments via crafted URLs.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization"}]}], "providerMetadata": {"orgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3", "shortName": "Liferay", "dateUpdated": "2025-10-13T17:14:58.696Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-62243", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-14T15:06:20.225891Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2025-10-14T15:06:26.632Z"}}]}, "cveMetadata": {"cveId": "CVE-2025-62243", "state": "PUBLISHED", "dateUpdated": "2025-10-13T17:14:58.696Z", "dateReserved": "2025-10-09T20:58:49.217Z", "assignerOrgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3", "datePublished": "2025-10-13T17:14:58.696Z", "assignerShortName": "Liferay"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Portal", "vendor": "Liferay", "versions": [{"lessThanOrEqual": "7.4.3.112", "status": "affected", "version": "7.4.1", "versionType": "maven"}]}, {"defaultStatus": "unaffected", "product": "DXP", "vendor": "Liferay", "versions": [{"lessThanOrEqual": "7.4.13-u92", "status": "affected", "version": "7.4.13", "versionType": "maven"}, {"lessThanOrEqual": "2023.Q3.8", "status": "affected", "version": "2023.Q3.1", "versionType": "maven"}, {"lessThanOrEqual": "2023.Q4.5", "status": "affected", "version": "2023.Q4.0", "versionType": "maven"}]}], "source": "security@liferay.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:*", "matchCriteriaId": "C3ED7CF1-6D8A-40F7-A009-F3A800F955BD", "versionEndExcluding": "2023.q3.9", "versionStartIncluding": "2023.q3.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:*", "matchCriteriaId": "7C41E249-91C4-4B2D-A8D2-C953A463E14F", "versionEndExcluding": "2023.q4.6", "versionStartIncluding": "2023.q4.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:-:*:*:*:*:*:*", "matchCriteriaId": "96E84DBC-C740-4E23-8D1D-83C8AE49813E", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update1:*:*:*:*:*:*", "matchCriteriaId": "8B1B2384-764F-43CC-8206-36DCBE9DDCBF", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update10:*:*:*:*:*:*", "matchCriteriaId": "C7B02106-D5EA-4A59-A959-CCE2AC8F55BC", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update11:*:*:*:*:*:*", "matchCriteriaId": "80204464-5DC5-4A52-B844-C833A96E6BD4", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update12:*:*:*:*:*:*", "matchCriteriaId": "6F8A5D02-0B45-4DA9-ACD8-42C1BFF62827", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update13:*:*:*:*:*:*", "matchCriteriaId": "38DA7C99-AC2C-4B9A-B611-4697159E1D79", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update14:*:*:*:*:*:*", "matchCriteriaId": "F264AD07-D105-4F00-8920-6D8146E4FA63", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update15:*:*:*:*:*:*", "matchCriteriaId": "C929CF16-4725-492A-872B-0928FE388FC9", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update16:*:*:*:*:*:*", "matchCriteriaId": "1B8750A1-E481-48D4-84F4-97D1ABE15B46", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update17:*:*:*:*:*:*", "matchCriteriaId": "454F8410-D9AC-481E-841C-60F0DF2CC25E", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update18:*:*:*:*:*:*", "matchCriteriaId": "D1A442EE-460F-4823-B9EF-4421050F0847", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update19:*:*:*:*:*:*", "matchCriteriaId": "608B205D-0B79-4D1C-B2C1-64C31DB1896E", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update2:*:*:*:*:*:*", "matchCriteriaId": "10B863B8-201D-494C-8175-168820996174", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update20:*:*:*:*:*:*", "matchCriteriaId": "4427DC78-E80C-4057-A295-B0731437A99E", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update21:*:*:*:*:*:*", "matchCriteriaId": "22B6B8C1-1FF3-41BC-9576-16193AE20CC7", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update22:*:*:*:*:*:*", "matchCriteriaId": "DDA17F24-1A7E-4BEB-9C98-41761A2A36A2", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update23:*:*:*:*:*:*", "matchCriteriaId": "3B062851-CE6B-44F4-8222-422EC9872EC3", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update24:*:*:*:*:*:*", "matchCriteriaId": "D4687FDA-0078-4E89-ADD8-7EDDA68261A4", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update25:*:*:*:*:*:*", "matchCriteriaId": "7EA29B09-CC24-4063-96A5-96AA08C0886D", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update26:*:*:*:*:*:*", "matchCriteriaId": "331FC246-D3E9-4711-B305-BE51BF743CF7", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update27:*:*:*:*:*:*", "matchCriteriaId": "A5823BC0-8C11-4C31-9E99-3C9D82918E2A", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update28:*:*:*:*:*:*", "matchCriteriaId": "E2E6CB66-1AE1-4626-8070-64C250ED8363", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update29:*:*:*:*:*:*", "matchCriteriaId": "B63449AA-6831-4290-B1FA-0BB806820402", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update3:*:*:*:*:*:*", "matchCriteriaId": "CBF766CE-CBB8-472A-BAF0-BD39A7BCB4DE", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update30:*:*:*:*:*:*", "matchCriteriaId": "B3B169F6-B8B8-4612-AD7D-F75CC6A9297B", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update31:*:*:*:*:*:*", "matchCriteriaId": "12D46756-D26D-4877-ACE8-1C2721908428", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update32:*:*:*:*:*:*", "matchCriteriaId": "5403DCEF-20C2-4568-8DF1-30804F522915", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update33:*:*:*:*:*:*", "matchCriteriaId": "90E39742-90BE-4DEB-AB78-F9B8F7333F9A", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update34:*:*:*:*:*:*", "matchCriteriaId": "9D07DB20-9DCF-4C05-99D2-F6B37A082C14", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update35:*:*:*:*:*:*", "matchCriteriaId": "341D1157-8118-4BD3-A902-36E90E066706", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update36:*:*:*:*:*:*", "matchCriteriaId": "1AB71307-7EAA-436A-9CBC-5A94F034FB48", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update37:*:*:*:*:*:*", "matchCriteriaId": "9446B3A5-6647-416C-92AF-7B6E0E929765", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update38:*:*:*:*:*:*", "matchCriteriaId": "06386C7A-CAA1-4FC4-9182-5A66342FB903", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update39:*:*:*:*:*:*", "matchCriteriaId": "8C84B701-B9A1-43D0-AF0C-30EDBD24CF90", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update4:*:*:*:*:*:*", "matchCriteriaId": "182FAA46-D9FB-4170-B305-BAD0DF6E5DE9", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update40:*:*:*:*:*:*", "matchCriteriaId": "BA9AF651-D118-4437-B400-531B26BF6801", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update41:*:*:*:*:*:*", "matchCriteriaId": "2B256485-E289-4092-B45B-835DE12625B9", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update42:*:*:*:*:*:*", "matchCriteriaId": "119B54BD-75F4-46A4-A57D-16CFF4E12CEB", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update43:*:*:*:*:*:*", "matchCriteriaId": "A3382E2D-A414-40A1-A330-619859756A36", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update44:*:*:*:*:*:*", "matchCriteriaId": "2E07B750-55B6-4DB6-B02B-216C2F5505A9", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update45:*:*:*:*:*:*", "matchCriteriaId": "B921E670-480F-4793-A636-3855A1654908", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update46:*:*:*:*:*:*", "matchCriteriaId": "62AE52FE-FB7F-4339-BDDE-E5AD235BBC58", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update47:*:*:*:*:*:*", "matchCriteriaId": "C99508DB-19E9-4832-AB38-57C61C7D68BC", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update48:*:*:*:*:*:*", "matchCriteriaId": "67F50AF8-7B0E-4D01-9EB2-C6625E9DACB6", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update49:*:*:*:*:*:*", "matchCriteriaId": "131E4E65-D997-47F1-8CB8-15CE6A60AB1D", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update5:*:*:*:*:*:*", "matchCriteriaId": "DF1BB9E6-D690-4C12-AEF0-4BD712869CBA", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update50:*:*:*:*:*:*", "matchCriteriaId": "CCD1DEA0-8823-4780-B5EE-C1A2BB3C6B4F", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update51:*:*:*:*:*:*", "matchCriteriaId": "94AC684E-3C5F-4859-B6EB-42C478F9DD11", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update52:*:*:*:*:*:*", "matchCriteriaId": "DC6FF5AB-B6E4-45D9-854B-29DEC200DA4D", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update53:*:*:*:*:*:*", "matchCriteriaId": "9855E3CB-925E-4623-A776-59422AB2FC6A", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update54:*:*:*:*:*:*", "matchCriteriaId": "01C3B7BE-1F9B-4EDA-990C-A4022CB85612", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update55:*:*:*:*:*:*", "matchCriteriaId": "65CF766C-626D-4F8C-BDBF-F0C5404DD545", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update56:*:*:*:*:*:*", "matchCriteriaId": "720EF24C-9A36-405B-A380-6114C150B376", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update57:*:*:*:*:*:*", "matchCriteriaId": "44479EF5-40BD-43A2-AD0F-CE1660222AB2", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update58:*:*:*:*:*:*", "matchCriteriaId": "B8E0BD92-0F77-481E-8167-F81755E00703", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update59:*:*:*:*:*:*", "matchCriteriaId": "2BDB885E-814A-4CA8-A81C-1DB35989089B", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update6:*:*:*:*:*:*", "matchCriteriaId": "653A0452-070F-4312-B94A-F5BCB01B9BDC", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update60:*:*:*:*:*:*", "matchCriteriaId": "B73DA1AE-C62F-4E62-AA98-5697656825F9", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update61:*:*:*:*:*:*", "matchCriteriaId": "D49DEE85-4DDB-4EF4-9F4D-11E7C1364055", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update62:*:*:*:*:*:*", "matchCriteriaId": "365F28B6-DBF2-45BB-A06D-DD80CFBAD7BD", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update63:*:*:*:*:*:*", "matchCriteriaId": "5FDAD47C-C2DA-4533-AA58-DD6EC09A580A", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update64:*:*:*:*:*:*", "matchCriteriaId": "5F81F36F-B20F-48B3-A1F2-3D319A34176B", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update65:*:*:*:*:*:*", "matchCriteriaId": "754329CD-30B7-4410-A371-56A7C261B61B", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update66:*:*:*:*:*:*", "matchCriteriaId": "C9445405-6B94-4DD1-BA94-B600AA316BB7", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update67:*:*:*:*:*:*", "matchCriteriaId": "960F3F22-9CC8-4655-9B09-777E5A5A1239", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update68:*:*:*:*:*:*", "matchCriteriaId": "D2B77C89-7F33-47A0-B6BF-473366033BEA", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update69:*:*:*:*:*:*", "matchCriteriaId": "8183B9D5-1C4D-4D30-BD85-13850FF34CB2", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update7:*:*:*:*:*:*", "matchCriteriaId": "15B67345-D0AF-4BFD-A62D-870F75306A4F", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update70:*:*:*:*:*:*", "matchCriteriaId": "1675366A-2388-4F7E-B423-D39BC7D3D38D", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update71:*:*:*:*:*:*", "matchCriteriaId": "B93C3CF2-4F45-4F6C-AB6D-F9ABDA7C4DA8", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update72:*:*:*:*:*:*", "matchCriteriaId": "34A6A6A0-9307-4F5D-9605-1F786D1CD62A", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update73:*:*:*:*:*:*", "matchCriteriaId": "6B994132-7103-4132-9D90-11CA264FEDE3", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update74:*:*:*:*:*:*", "matchCriteriaId": "A1958E04-AB8A-4B0E-AB45-B810CAED2EEF", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update75:*:*:*:*:*:*", "matchCriteriaId": "BB5558B0-6714-4B3A-B287-1943517A975A", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update76:*:*:*:*:*:*", "matchCriteriaId": "7E325115-EEBC-41F4-8606-45270DA40B98", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update77:*:*:*:*:*:*", "matchCriteriaId": "848B2C72-447D-46E2-A5A7-43CF3764E578", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update78:*:*:*:*:*:*", "matchCriteriaId": "26A0AF15-52A9-46FD-8157-359141332EAF", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update79:*:*:*:*:*:*", "matchCriteriaId": "63D63872-C1D0-444F-BCC7-A514F323C256", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update8:*:*:*:*:*:*", "matchCriteriaId": "DE1F4262-A054-48CC-BF1D-AA77A94FFFE4", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update80:*:*:*:*:*:*", "matchCriteriaId": "9D9FA9AD-39D3-412A-B794-E1B29EEEEC4A", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update81:*:*:*:*:*:*", "matchCriteriaId": "294D8A56-A797-433C-A06E-106B2179151A", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update82:*:*:*:*:*:*", "matchCriteriaId": "824D88D9-4645-4CAD-8CAB-30F27DD388C4", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update83:*:*:*:*:*:*", "matchCriteriaId": "F6E8C952-B455-46E4-AC3D-D38CAF189F60", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update84:*:*:*:*:*:*", "matchCriteriaId": "CD77C0EE-AC79-4443-A502-C1E02F806911", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update85:*:*:*:*:*:*", "matchCriteriaId": "648EB53C-7A90-4DA6-BF1C-B5336CDE30C7", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update86:*:*:*:*:*:*", "matchCriteriaId": "39835EF7-8E93-4695-973D-6E9B76C67372", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update87:*:*:*:*:*:*", "matchCriteriaId": "2A05FB86-332B-44E3-93CB-82465A38976E", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update88:*:*:*:*:*:*", "matchCriteriaId": "7C754823-899C-4EEF-ACB7-E1551FA88B25", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update89:*:*:*:*:*:*", "matchCriteriaId": "493D4C18-DEE2-4040-9C13-3A9AB2CE47BF", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update9:*:*:*:*:*:*", "matchCriteriaId": "D176CECA-2821-49EA-86EC-1184C133C0A3", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update90:*:*:*:*:*:*", "matchCriteriaId": "8F17DD75-E63B-4E4C-B136-D43F17B389EF", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update91:*:*:*:*:*:*", "matchCriteriaId": "62EE759A-78AD-40D6-8C5B-10403A8A4A89", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update92:*:*:*:*:*:*", "matchCriteriaId": "865ABA1F-CA99-4602-B325-F81C9778855C", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*", "matchCriteriaId": "26C6657F-B0C5-46DD-9FE5-25004EC2003D", "versionEndExcluding": "7.4.3.113", "versionStartIncluding": "7.4.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Insecure direct object reference (IDOR) vulnerability in Publications in Liferay Portal 7.4.1 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92 allows remote authenticated attackers to view publication comments via the _com_liferay_change_tracking_web_portlet_PublicationsPortlet_value parameter.\n\nPublications comments in Liferay Portal 7.4.1 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92 does not properly check user permissions, which allows remote authenticated users to edit publication comments via crafted URLs."}, {"lang": "es", "value": "Vulnerabilidad de referencia directa a objeto insegura (IDOR) en Publicaciones en Liferay Portal 7.4.1 hasta 7.4.3.112, y Liferay DXP 2023.Q4.0 hasta 2023.Q4.5, 2023.Q3.1 hasta 2023.Q3.8, y 7.4 GA hasta la actualizaci\u00f3n 92 permite a atacantes remotos autenticados ver comentarios de publicaciones a trav\u00e9s del par\u00e1metro _com_liferay_change_tracking_web_portlet_PublicationsPortlet_value.\n\nLos comentarios de publicaciones en Liferay Portal 7.4.1 hasta 7.4.3.112, y Liferay DXP 2023.Q4.0 hasta 2023.Q4.5, 2023.Q3.1 hasta 2023.Q3.8, y 7.4 GA hasta la actualizaci\u00f3n 92 no verifica correctamente los permisos de usuario, lo que permite a usuarios remotos autenticados editar comentarios de publicaciones a trav\u00e9s de URLs manipuladas."}], "id": "CVE-2025-62243", "lastModified": "2026-10-18T21:10:00.120", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security@liferay.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-62243", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-14T15:06:20.225891Z", "version": "2.0.3"}}]}, "published": "2025-10-13T18:15:35.160", "references": [{"source": "security@liferay.com", "tags": ["Vendor Advisory"], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62243"}], "sourceIdentifier": "security@liferay.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "security@liferay.com", "type": "Secondary"}]}

{}

{"created": "2025-10-20T16:13:22.448103+00:00", "updated": "2025-10-20T16:13:22.448136+00:00", "vendors": ["liferay", "liferay$PRODUCT$dxp", "liferay$PRODUCT$portal"]}