Liferay Portal CVE-2025-62245

Exploitation requires tricking an already-authenticated Liferay user who has permission to add or edit publication comments into visiting attacker-controlled content, so that their browser submits a forged request against the publications/comments feature (reflected by UI:A in the vector). Limiting factors: the attack is confined to adding/editing publication comments (integrity-only, VI:L; no data disclosure or availability impact), it depends on the victim being logged in and interacting with the malicious content, and it is gated by missing or bypassable CSRF protection on that specific endpoint. It affects Liferay Portal 7.4.1 through 7.4.3.112 and Liferay DXP 2023.Q4.0-2023.Q4.5, 2023.Q3.1-2023.Q3.10, and 7.4 GA through update 92.

This is a genuinely low-to-moderate priority issue despite its MEDIUM CVSS 4.0 score of 5.1. The signals are internally consistent and point away from urgency: the CVSS vector (AV:N/AC:L/PR:N/UI:A) shows a network-reachable, low-complexity flaw requiring no attacker privileges but requiring active victim interaction (UI:A), and the only impact is low integrity (VI:L) - confidentiality and availability are untouched (VC:N/VA:N), which is typical for a CSRF (CWE-352) whose effect is limited to adding and editing publication comments. EPSS reinforces low real-world risk at 0.19% (8th percentile). There is no CISA KEV listing and no public exploit identified, so there is no confirmed active exploitation and no publicly available exploit code. No conflicting signals are present: the low EPSS, absence of KEV, limited integrity-only impact, and user-interaction requirement all agree that this is a low-real-risk, low-severity CSRF rather than a high-priority threat. The main caveat is that the required user interaction depends on luring an authenticated/privileged user into triggering a forged request, which caps practical exploitability.

An attacker crafts a malicious web page or email containing a forged request targeting the Liferay publication comments endpoint and lures a logged-in Liferay user into visiting it; the victim's browser silently submits the request, causing a comment to be added or edited under the victim's session. No public exploit code is identified, and success depends on the victim being authenticated and interacting with the attacker-controlled content.