CVE-2025-43745 json
Liferay Portal CSRF Vulnerability via Endpoint Parameter
published 2025-08-19 14 mo ago modified 2026-06-17 4 mo ago also GHSA-7q33-gwcm-r6cj , EUVD-2025-25202
- cvss
- 6.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 16%
- public exploits
- 0
- none known
Summary
A CSRF vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.7, 2025.Q1.0 through 2025.Q1.14, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19 and 7.4 GA through update 92 allows remote attackers to performs cross-origin request on behalf of the authenticated user via the endpoint parameter.
Patch / fix
- liferay digital_experience_platform 2024.q1.20, 2025.Q1.16, 2025.Q2.8
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 14 mo ago
Exploit prediction
0.25% chance of exploitation in the next 30 days, higher than 16% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | com.liferay.portal:release.portal.bom | >=7.4.0-ga1, <=7.4.3.132-ga132 |
no fix listed |
Affected products
- Liferay Portal
- Liferay DXP
Classification
- Weakness
-
- CWE-352 Cross-Site Request Forgery
References
-
github.com
/liferay/liferay-portal/commit/037b58f96c9ded47960ab493a68d68aaf32b1a43
web
-
github.com
/liferay/liferay-portal/commit/2387ee78fd471ea1c1c4d696aa0cbb1bce72665e
web
-
github.com
/liferay/liferay-portal/commit/729dfc202c9d2724b5f3f749ead14eb13832e101
web
-
liferay.dev
/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43745
web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2025-43745
advisory
-
github.com
/liferay/liferay-portal
package
-
liferay.atlassian.net
/browse/LPE-18275
web
Sources
- CVE List CVE-2025-43745
- GitHub Advisory GHSA-7q33-gwcm-r6cj
- NVD CVE-2025-43745
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.