CVE-2025-43748

CVSS v3 6.8 MEDIUM

6.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

I

nsufficient CSRF protection for omni-administrator users in Liferay Portal 7.0.0 through 7.4.3.119, and Liferay DXP 2024.Q1.1 through 2024.Q1.6, 2023.Q4.0 through 2023.Q4.9, 2023.Q3.1 through 2023.Q3.9, 7.4 GA through update 92, 7.3 GA through update 36, and older unsupported versions allows attackers to execute Cross-Site Request Forgery

References

Link	Resource
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43748	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:liferay:digital_experience_platform::::::::
	cpe:2.3:a:liferay:digital_experience_platform::::::::
	cpe:2.3:a:liferay:digital_experience_platform::::::::
	cpe:2.3:a:liferay:digital_experience_platform::::::::
	cpe:2.3:a:liferay:liferay_portal::::::::
	cpe:2.3:a:liferay:liferay_portal:6.2:-:::enterprise:::*

History

16 Dec 2025, 14:59

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 6.8
CPE		cpe:2.3:a:liferay:liferay_portal:::::::: cpe:2.3:a:liferay:liferay_portal:6.2:-:::enterprise:::* cpe:2.3:a:liferay:digital_experience_platform::::::::
References	~~() https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43748 -~~	() https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43748 - Vendor Advisory
First Time		Liferay digital Experience Platform Liferay Liferay liferay Portal

22 Aug 2025, 18:09

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-08-20 15:15

Updated : 2025-12-16 14:59

NVD link : CVE-2025-43748

Mitre link : CVE-2025-43748

CVE.ORG link : CVE-2025-43748

JSON object : View

Products Affected

CWE

CWE-352

Cross-Site Request Forgery (CSRF)

{"id": "CVE-2025-43748", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.9}], "cvssMetricV40": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-08-20T15:15:32.783", "references": [{"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43748", "tags": ["Vendor Advisory"], "source": "[email protected]"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "Insufficient CSRF protection for omni-administrator users in Liferay Portal 7.0.0 through 7.4.3.119, and Liferay DXP 2024.Q1.1 through 2024.Q1.6, 2023.Q4.0 through 2023.Q4.9, 2023.Q3.1 through 2023.Q3.9, 7.4 GA through update 92, 7.3 GA through update 36, and older unsupported versions allows attackers to execute Cross-Site Request Forgery"}, {"lang": "es", "value": "La protecci\u00f3n CSRF insuficiente para usuarios omniadministradores en Liferay Portal 7.0.0 a 7.4.3.119, y Liferay DXP 2024.Q1.1 a 2024.Q1.6, 2023.Q4.0 a 2023.Q4.9, 2023.Q3.1 a 2023.Q3.9, 7.4 GA a la actualizaci\u00f3n 92, 7.3 GA a la actualizaci\u00f3n 36 y versiones anteriores no compatibles permite a los atacantes ejecutar Cross Site Request Forgery."}], "lastModified": "2025-12-16T14:59:16.697", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "33A145DE-6BDB-4B2E-BB6B-84CC085C8D11", "versionEndIncluding": "7.4", "versionStartIncluding": "7.0"}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0037B60D-9BF2-4158-BBFA-1584379F66D5", "versionEndIncluding": "2023.Q3.9", "versionStartIncluding": "2023.Q3.1"}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AAB0B350-37CD-4E31-A110-D1F3035048DE", "versionEndIncluding": "2023.Q4.9", "versionStartIncluding": "2023.Q4.0"}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7050CC18-2F9E-4F1F-8394-B12860DEBA0D", "versionEndExcluding": "2024.Q1.7", "versionStartIncluding": "2024.Q1.1"}, {"criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "86941C43-26A4-40A4-BBF1-5559E46086B6", "versionEndExcluding": "7.4.3.120", "versionStartIncluding": "7.0.0"}, {"criteria": "cpe:2.3:a:liferay:liferay_portal:6.2:-:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "45888C16-DD71-4704-8DBF-BEAF9778DFDA"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}