← Back

CVE-2025-43748

nvd nist
Published: Aug 20, 2025Modified: Dec 16, 2025

JSON object

Loading...
7.1
Vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Show more
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less
Source: security@liferay.com (Secondary)

Description

Insufficient CSRF protection for omni-administrator users in Liferay Portal 7.0.0 through 7.4.3.119, and Liferay DXP 2024.Q1.1 through 2024.Q1.6, 2023.Q4.0 through 2023.Q4.9, 2023.Q3.1 through 2023.Q3.9, 7.4 GA through update 92, 7.3 GA through update 36, and older unsupported versions allows attackers to execute Cross-Site Request Forgery

Affected (6)

Liferay
2 products
Digital Experience Platform
Liferay Portal
Configuration A
6 vulnerable
Vulnerable SoftwareAffected Versions
Liferay
Digital Experience Platform
From 2023.Q3.1 to 2023.Q3.9
Digital Experience Platform
From 2023.Q4.0 to 2023.Q4.9
Digital Experience Platform
From 2024.Q1.1 to 2024.Q1.7
Digital Experience Platform
From 7.0 to 7.4
Liferay
Liferay Portal
From 7.0.0 to 7.4.3.120
Liferay Portal
Version 6.2

Related CWEs

CWE-352
Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

References (1)

Source: security@liferay.com
Vendor Advisory

Timeline

No history available yet.