High severityNVD Advisory· Published Aug 20, 2025· Updated Feb 26, 2026

CVE-2025-43748

Description

Insufficient CSRF protection for omni-administrator users in Liferay Portal 7.0.0 through 7.4.3.119, and Liferay DXP 2024.Q1.1 through 2024.Q1.6, 2023.Q4.0 through 2023.Q4.9, 2023.Q3.1 through 2023.Q3.9, 7.4 GA through update 92, 7.3 GA through update 36, and older unsupported versions allows attackers to execute Cross-Site Request Forgery

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
com.liferay.portal:release.portal.bomMaven	>= 7.0.0-a1, < 7.4.3.120-ga120	7.4.3.120-ga120

Affected products

Liferay/Portalv5
Range: 7.0.0
Liferay/DXPv5
Range: 6.2.0

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

github.com/advisories/GHSA-p9gc-59hf-x48pghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2025-43748ghsaADVISORY
liferay.atlassian.net/browse/LPE-17839ghsaWEB
liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43748ghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.455
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000