GHSA-p9gc-59hf-x48p

ghsaUSosv

Liferay Portal Vulnerable to Cross-Site Request Forgery

view advisory published 2025-08-20Licence: CC-BY-4.0

Insufficient CSRF protection for omni-administrator users in Liferay Portal 7.0.0 through 7.4.3.119, and Liferay DXP 2024.Q1.1 through 2024.Q1.6, 2023.Q4.0 through 2023.Q4.9, 2023.Q3.1 through 2023.Q3.9, 7.4 GA through update 92, 7.3 GA through update 36, and older unsupported versions allows attackers to execute Cross-Site Request Forgery

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2025-43748US	medium6.8	0.17% (6th)	—	2025-08-20
Insufficient CSRF protection for omni-administrator users in Liferay Portal 7.0.0 through 7.4.3.119, and Liferay DXP 2024.Q1.1 through 2024.Q1.6, 2023.Q4.0 through 2023.Q4.9, 2023.…

references

External citations — patches, advisories, analysis.

https://github.com/liferay/liferay-portalPACKAGE
https://liferay.atlassian.net/browse/LPE-17839WEB
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43748WEB
https://nvd.nist.gov/vuln/detail/CVE-2025-43748ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan