CVE-2025-43748

Summary

Insufficient CSRF protection for omni-administrator users in Liferay Portal 7.0.0 through 7.4.3.119, and Liferay DXP 2024.Q1.1 through 2024.Q1.6, 2023.Q4.0 through 2023.Q4.9, 2023.Q3.1 through 2023.Q3.9, 7.4 GA through update 92, 7.3 GA through update 36, and older unsupported versions allows attackers to execute Cross-Site Request Forgery

Affected Software

VendorProductVersion RangeStatus
LiferayPortal7.0.0 <= 7.4.3.119affected
LiferayDXP6.2.0 <= portal-173affected
LiferayDXP7.0.10 <= de-102affected
LiferayDXP7.1.10 <= dxp-28affected
LiferayDXP7.2.10 <= dxp-20affected
LiferayDXP7.3.10 <= 7.3.10-u36affected
LiferayDXP7.4.13 <= 7.4.13-u92affected
LiferayDXP2023.Q3.1 <= 2023.Q3.9affected
LiferayDXP2023.Q4.0 <= 2023.Q4.9affected
LiferayDXP2024.Q1.1 <= 2024.Q1.6affected

Weaknesses

  • CWE-352: CWE-352 Cross-Site Request Forgery (CSRF)

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References