CVE-2025-43748

MEDIUM

Liferay Digital Experience Platform < 7.4 - CSRF

Title source: rule

Description

Insufficient CSRF protection for omni-administrator users in Liferay Portal 7.0.0 through 7.4.3.119, and Liferay DXP 2024.Q1.1 through 2024.Q1.6, 2023.Q4.0 through 2023.Q4.9, 2023.Q3.1 through 2023.Q3.9, 7.4 GA through update 92, 7.3 GA through update 36, and older unsupported versions allows attackers to execute Cross-Site Request Forgery

References (1)

[Vendor Advisory] https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43748

Scores

CVSS v3 6.8

EPSS 0.0002

EPSS Percentile 5.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Classification

CWE

CWE-352

Status published

Affected Products (4)

liferay/digital_experience_platform < 7.4

liferay/liferay_portal < 7.4.3.120

liferay/liferay_portal

com.liferay.portal/release.portal.bom < 7.4.3.120-ga120Maven

Timeline

Published Aug 20, 2025

Tracked Since Feb 18, 2026