CVE-2025-43748: CSRF
Insufficient CSRF protection for omni-administrator users in Liferay Portal 7.0.0 through 7.4.3.119, and Liferay DXP 2024.Q1.1 through 2024.Q1.6, 2023.Q4.0 through 2023.Q4.9, 2023.Q3.1 through 2023.Q3.9, 7.4 GA through update 92, 7.3 GA through update 36, and older unsupported versions allows attackers to execute Cross-Site Request Forgery
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-43748?
CVE-2025-43748 is rated as a medium severity vulnerability due to insufficient CSRF protection for omni-administrator users.
How do I fix CVE-2025-43748?
To fix CVE-2025-43748, upgrade to the latest patched version of Liferay Portal or Liferay DXP that addresses this CSRF vulnerability.
Which versions are affected by CVE-2025-43748?
CVE-2025-43748 affects Liferay Portal versions 7.0.0 through 7.4.3.119 and Liferay DXP versions 2024.Q1.1 through 2024.Q1.6 among others.
What kind of attack can exploit CVE-2025-43748?
CVE-2025-43748 can be exploited through Cross-Site Request Forgery (CSRF) attacks, allowing unauthorized actions to be executed by omni-administrator users.
Is there a temporary workaround for CVE-2025-43748?
A temporary workaround for CVE-2025-43748 may involve implementing additional security measures to validate requests until the software can be updated.