CVE-2025-43809: Liferay Portal CSRF Vulnerability in License Registration
Summary
CVE-2025-43809: Liferay Portal Cross-Site Request Forgery (CSRF) vulnerability. Affects com.liferay.portal:com.liferay.portal.impl versions < 101.0.0. Fixed in 101.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Liferay Portal is a popular open-source platform for building web applications and managing content. It provides features such as user management, content management, and collaboration tools. The affected package, com.liferay.portal.impl, is integral to the functionality of Liferay Portal, handling the implementation of portal features. However, it has been found vulnerable to a Cross-Site Request Forgery (CSRF) attack, which could allow unauthorized actions to be performed on behalf of users.
Vulnerability Detail
The vulnerability arises from a CSRF flaw in the server license registration page of Liferay Portal versions 7.4.0 through 7.4.3.111 and older unsupported versions, as well as Liferay DXP versions 2023.Q4.0 through 2023.Q4.7 and 2023.Q3.1 through 2023.Q3.9. This flaw allows remote attackers to exploit the 'orderUuid' parameter to register a server license without proper authorization. The ramifications of this vulnerability include unauthorized access to server functionalities and potential misuse of server resources.
How To Fix
Minimum fixed version
101.0.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider implementing CSRF tokens in your application to validate requests made to the server license registration page. This can help mitigate the risk of CSRF attacks until the package is updated.
Conclusion
The CSRF vulnerability identified as CVE-2025-43809 in Liferay Portal poses a significant risk to users of the affected versions. It is crucial to update to the patched version to safeguard against potential exploitation. Implementing additional security measures, such as CSRF tokens, can further enhance protection.
See every vulnerability recorded for com.liferay.portal:com.liferay.portal.impl →
FAQ
A CSRF vulnerability allows an attacker to trick a user into executing unwanted actions on a web application in which they are authenticated.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By checking your pom.xml file, you can determine if your application is affected by this vulnerability.
Not fixing this vulnerability could lead to unauthorized actions being performed on your server, potentially compromising sensitive data and server integrity.
Yes, implementing CSRF tokens can help mitigate the risk of CSRF attacks until the package is updated.
More information can be found in the official advisory on GitHub and through security bulletins related to Liferay Portal.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.liferay.portal:com.liferay.portal.impl.
