GitHub Advisoryadvisory · Maven

GHSA-7q33-gwcm-r6cj Liferay Portal CSRF Vulnerability via Endpoint Parameter

MEDIUM Published 2025-08-19 Modified 2025-08-20 Official page ↗
Aliases
CVE-2025-43745
Ecosystem
Maven
Packages
com.liferay.portal:release.portal.bom
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weaknesses
CWE-352
Reviewed
2025-08-20

Affected packages

• Maven com.liferay.portal:release.portal.bom: >= 7.4.0-ga1, <= 7.4.3.132-ga132 (no fix yet)

Description

A CSRF vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.7, 2025.Q1.0 through 2025.Q1.14, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19 and 7.4 GA through update 92 allows remote attackers to performs cross-origin request on behalf of the authenticated user via the endpoint parameter.

Related

Alias · CVE (1)

  • CVE-2025-43745 A CSRF vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.7, 2025.Q1.0 through 2025.Q1.14,… vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References