High severityNVD Advisory· Published Aug 20, 2025· Updated Feb 26, 2026

CVE-2025-43748

Description

Insufficient CSRF protection for omni-administrator users in Liferay Portal 7.0.0 through 7.4.3.119, and Liferay DXP 2024.Q1.1 through 2024.Q1.6, 2023.Q4.0 through 2023.Q4.9, 2023.Q3.1 through 2023.Q3.9, 7.4 GA through update 92, 7.3 GA through update 36, and older unsupported versions allows attackers to execute Cross-Site Request Forgery

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
com.liferay.portal:release.portal.bomMaven	>= 7.0.0-a1, < 7.4.3.120-ga120	7.4.3.120-ga120

Affected products

ghsa-coords
pkg:maven/com.liferay.portal/release.portal.bom
Range: >= 7.0.0-a1, < 7.4.3.120-ga120
Liferay/Portalv5
Range: 7.0.0
Liferay/DXPcpe-rescue
Range: 6.2.0

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-p9gc-59hf-x48pghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2025-43748ghsaADVISORY
liferay.atlassian.net/browse/LPE-17839ghsaWEB
liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43748ghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.455
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000