CVE-2025-43809CWE-352csrf

CVE-2025-43809

Medium · published September 20, 2025

CVSS v3.1
4.3
EPSS
0%
Percentile
7.3
In the wild
Unconfirmed
What it is

Cross-Site Request Forgery (CSRF) vulnerability in the server (license) registration page in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.7, 2023.Q3.1 through 2023.Q3.9, 7.4 GA through update 92, and older unsupported versions allows remote attackers to register a server license via the 'orderUuid' parameter.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00181 · 7.3th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2025-09-20T00:15Z
Affected products (4)
ProductVersionsFixed in
liferay/digital_experience_platform≤ 7.4—
liferay/digital_experience_platform≥ 2023.q3.1, < 2023.q3.92023.q3.9
liferay/digital_experience_platform≥ 2023.Q4.0, < 2023.Q4.82023.Q4.8
liferay/liferay_portal≥ 7.4.0, < 7.4.3.1127.4.3.112
References (1)
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43809 · [email protected]
EPSS history
Timeline
  • 19 SEP 19:15Z
    Cross-Site Request Forgery (CSRF) vulnerability in the server (license) registration page in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported…
    cvelistv5