IT-Sentinel

« BACK_TO_HOME

PUBLISHED

2025-09-19 20:15

MODIFIED

2025-09-22 21:23

EPSS (Prob. Exploit)

0.18%

Top 92.7%

DATA SOURCES:

NVD 🔗 2025-10-18 CVE PROJECT 🔗 2026-01-19 FIRST EPSS 🔗 2026-10-25 GITHUB 🔗 2026-11-04 OSV 🔗 2026-09-20

> DESCRIPTION

Cross-Site Request Forgery (CSRF) vulnerability in the server (license) registration page in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.7, 2023.Q3.1 through 2023.Q3.9, 7.4 GA through update 92, and older unsupported versions allows remote attackers to register a server license via the 'orderUuid' parameter.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> GITHUB SECURITY ADVISORY

GHSA-697h-3q6m-jwp4 MODERATE

Liferay Portal Cross-Site Request Forgery (CSRF) vulnerability

AFFECTED PACKAGES:

MAVEN / com.liferay.portal:com.liferay.portal.impl

< 101.0.0

Fixed in: 101.0.0

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

AFFECTED PACKAGES:

Unknown / Unknown

9 versions affected

ALIASES:

GHSA-697h-3q6m-jwp4

> HISTORIQUE DES MODIFICATIONS

Première apparition

19/09/2025 20:15

Source: NVD

📊 ENRICHISSEMENT 18/10/2025 15:08

CVEPROJECT

Champ modifié: CVE Project

Ancienne valeur:

Non

Nouvelle valeur:

Oui