A CSRF vulnerability exists in Liferay Portal versions 7.4.0 through 7.4.3.132 and Liferay DXP versions 2025.Q2.0 through 2025.Q2.7, among others. This vulnerability allows remote attackers to perform cross-origin requests on behalf of authenticated users via the endpoint parameter. The issue affects multiple versions of the software, making it critical for users to address.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.9 | CVE-2025-43745 |
Exploitation
To exploit this vulnerability, an attacker must trick an authenticated user into clicking a malicious link that sends a crafted request to the vulnerable Liferay Portal or DXP instance. This can be achieved through social engineering techniques, such as phishing emails or malicious websites, which leverage the user’s authenticated session to perform unauthorized actions.
Affected Products
- Liferay Portal 7.4.0 to 7.4.3.132: A widely used platform for building web applications.
- Liferay DXP 2025.Q2.0 to 2025.Q2.7: The enterprise version of Liferay, offering additional features and support.
- Liferay DXP 2024 and earlier versions: Various releases that are also impacted by this vulnerability.
Mitigation
To mitigate this vulnerability, it is recommended that users upgrade to the latest versions of Liferay Portal and DXP that address this CSRF issue. Additionally, implementing security measures such as CSRF tokens and ensuring proper user input validation can help protect against such attacks.