GHSA-9676-rh83-cr86

Suggest an improvement
Source
https://github.com/advisories/GHSA-9676-rh83-cr86
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-9676-rh83-cr86/GHSA-9676-rh83-cr86.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-9676-rh83-cr86
Aliases
Published
2025-10-10T21:31:16Z
Modified
2025-10-13T13:57:22.583484Z
Severity
  • 5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Liferay Portal is vulnerable to CSRF through publication comments
Details

Cross-site request forgery (CSRF) vulnerability in Liferay Portal 7.4.1 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92 allows remote attackers to add and edit publication comments.

Database specific 
{
    "nvd_published_at": "2025-10-10T20:15:39Z",
    "severity": "MODERATE",
    "github_reviewed_at": "2025-10-13T13:34:22Z",
    "cwe_ids": [
        "CWE-352"
    ],
    "github_reviewed": true
}
References

Affected packages

Maven / com.liferay:com.liferay.change.tracking.web

Package

Name
com.liferay:com.liferay.change.tracking.web
View open source insights on deps.dev
Purl
pkg:maven/com.liferay/com.liferay.change.tracking.web

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.0.9
Fixed
2.0.121

Affected versions

2.*
2.0.9
2.0.10
2.0.11
2.0.12
2.0.13
2.0.14
2.0.15
2.0.16
2.0.17
2.0.18
2.0.19
2.0.20
2.0.21
2.0.22
2.0.23
2.0.24
2.0.25
2.0.26
2.0.27
2.0.28
2.0.29
2.0.30
2.0.31
2.0.32
2.0.33
2.0.34
2.0.35
2.0.36
2.0.37
2.0.38
2.0.39
2.0.40
2.0.41
2.0.42
2.0.43
2.0.44
2.0.45
2.0.46
2.0.47
2.0.48
2.0.49
2.0.50
2.0.51
2.0.52
2.0.53
2.0.54
2.0.55
2.0.56
2.0.57
2.0.58
2.0.59
2.0.60
2.0.61
2.0.62
2.0.63
2.0.64
2.0.65
2.0.66
2.0.67
2.0.68
2.0.69
2.0.70
2.0.71
2.0.72
2.0.73
2.0.74
2.0.75
2.0.76
2.0.77
2.0.78
2.0.79
2.0.80
2.0.81
2.0.82
2.0.83
2.0.84
2.0.85
2.0.86
2.0.87
2.0.88
2.0.89
2.0.90
2.0.91
2.0.92
2.0.93
2.0.94
2.0.95
2.0.96
2.0.97
2.0.98
2.0.99
2.0.100
2.0.101
2.0.102
2.0.103
2.0.104
2.0.105
2.0.106
2.0.107
2.0.108
2.0.109
2.0.110
2.0.111
2.0.112
2.0.113
2.0.114
2.0.115
2.0.116
2.0.117
2.0.118
2.0.119
2.0.120

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-9676-rh83-cr86/GHSA-9676-rh83-cr86.json"