Insufficient CSRF protection for omni-administrator users in Liferay Portal versions 7.0.0 through 7.4.3.119, and Liferay DXP versions 2024.Q1.1 through 2024.Q1.6, 2023.Q4.0 through 2023.Q4.9, and 2023.Q3.1 through 2023.Q3.9 allows attackers to execute Cross-Site Request Forgery. This vulnerability affects both supported and older unsupported versions of the software.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.1 | CVE-2025-43748 |
Exploitation
To exploit this vulnerability, an attacker must have high privileges and be able to interact with the target system. By leveraging the insufficient CSRF protection, the attacker can craft malicious requests that can be executed by the omni-administrator user, potentially leading to unauthorized actions within the Liferay Portal.
Affected Products
- Liferay Portal 7.0.0 through 7.4.3.119: A widely used enterprise portal solution.
- Liferay DXP 2024.Q1.1 through 2024.Q1.6: The latest version of the Digital Experience Platform.
- Older unsupported versions: Previous versions that are no longer maintained but still in use.
Mitigation
To mitigate this vulnerability, it is recommended that users upgrade to the latest version of Liferay Portal or DXP that addresses the CSRF protection issue. Additionally, implementing additional security measures such as web application firewalls and regular security audits can help reduce the risk of exploitation.