Liferay Portal CVE-2025-62258

Exploitation requires (1) a victim who is already authenticated to the Liferay Portal/DXP instance - practical impact scales with the victim's privilege level, with administrators being the high-value target; (2) that victim performing active user interaction (UI:A) by visiting attacker-controlled web content while their session is valid; and (3) the Headless API being reachable, with the forged request abusing the endpoint parameter to select an arbitrary Headless API action. The core limiting factor is the CSRF dependency: the attacker cannot invoke the API directly but must successfully socially engineer an authenticated user, meaning instances whose privileged users are trained against such lures, or that enforce robust anti-CSRF tokens/SameSite cookies at the gateway, face reduced real-world risk. Affected: Liferay Portal 7.4.0 through 7.4.3.107 and Liferay DXP 2023.Q3.1-2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions.

This is a moderate-priority issue rather than a critical emergency. The CVSS 4.0 base score of 7.0 (HIGH) reflects a network vector (AV:N), low attack complexity (AC:L), no attacker privileges (PR:N), but crucially requires active user interaction (UI:A) - characteristic of CSRF (CWE-352), where an attacker cannot act alone but must lure an authenticated victim into triggering the request. The impact profile (VC:L/VI:H/VA:N) indicates high integrity impact (the attacker can invoke any Headless API action in the victim's context) with only low confidentiality exposure and no availability impact. EPSS strongly tempers this: 0.18% probability at the 7th percentile signals very low likelihood of observed exploitation. There is no CISA KEV listing and no public exploit code identified, so this is not evidence of active or widespread exploitation. The signals are internally consistent - a genuinely exploitable but interaction-gated flaw with no current exploitation momentum. The practical risk hinges on whether privileged Liferay users (especially administrators) can be socially engineered into visiting attacker content while authenticated; absent that, mass automated exploitation is unlikely. Note the CVSS 4.0 vector omits a parallel CVSS 3.1 vector, and no SSVC decision data was provided, so exploitation-maturity and automatability cannot be independently cross-checked.

An attacker hosts a malicious web page (or embeds hidden form/script content in an email or compromised site) that issues a forged request to a target Liferay instance's Headless API, supplying an attacker-chosen action via the endpoint parameter. When an already-authenticated Liferay user - ideally an administrator - visits the page, their browser automatically submits the request with their valid session, causing the chosen Headless API operation to execute on their behalf. No public exploit code has been identified at time of analysis, but the technique is straightforward given low attack complexity.