CVE-2025-43809: 
Java vulnerability analysis and mitigation

Cross-Site Request Forgery (CSRF) vulnerability was discovered in the server (license) registration page of Liferay Portal and Liferay DXP. The vulnerability was assigned CVE-2025-43809 and was publicly disclosed on September 19, 2025. The affected versions include Liferay Portal 7.4.0 through 7.4.3.111, Liferay DXP 2023.Q4.0 through 2023.Q4.7, Liferay DXP 2023.Q3.1 through 2023.Q3.8, and Liferay DXP 7.4, along with older unsupported versions (Liferay Security).

The vulnerability allows remote attackers to register a server license via the 'orderUuid' parameter through a CSRF attack. The severity of the vulnerability has been assessed with a CVSS v4.0 score of 5.1 (Medium), with the following vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. The vulnerability is classified under CWE-352 (Cross-Site Request Forgery) (NVD Database).

The vulnerability enables attackers to perform unauthorized server license registration actions by exploiting the CSRF weakness. This could potentially lead to integrity issues in the license management system (Liferay Security).

The vulnerability has been fixed in the following versions: Liferay Portal 7.4.3.112, Liferay DXP 2024.Q1.1, Liferay DXP 2023.Q4.8, and Liferay DXP 2023.Q3.9. Users are advised to upgrade to these patched versions to mitigate the vulnerability (Liferay Security).