CVE-2025-62243: 
Java vulnerability analysis and mitigation

CVE-2025-62243 is an Insecure Direct Object Reference (IDOR) vulnerability affecting Publications in Liferay Portal 7.4.1 through 7.4.3.112, and Liferay DXP versions 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92. The vulnerability was reported by researcher foobar7 and was published on September 16, 2024 (Liferay Security).

The vulnerability consists of two main issues in the Publications component: an IDOR vulnerability that allows remote authenticated attackers to view publication comments through the comliferaychangetrackingwebportletPublicationsPortletvalue parameter, and an improper permission check that enables remote authenticated users to edit publication comments using crafted URLs. The vulnerability has been assigned a CVSS v4.0 score of 5.3 (MEDIUM) with the vector string CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N (Liferay Security).

The vulnerability allows authenticated attackers to both view and edit publication comments without proper authorization, potentially compromising the confidentiality and integrity of sensitive information in the Publications component (Liferay Security).

The vulnerability has been fixed in Liferay Portal version 7.4.3.113 and Liferay DXP versions 2024.Q2.0, 2024.Q1.1, 2023.Q4.6, and 2023.Q3.9. Organizations using affected versions should upgrade to these patched versions to mitigate the vulnerability (Liferay Security).