Home

Description

A server-side request forgery (SSRF) vulnerability exist in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13 and 2024.Q1.1 through 2024.Q1.20 that affects custom object attachment fields. This flaw allows an attacker to manipulate the application into making unauthorized requests to other instances, creating new object entries that link to external resources.

PUBLISHED Reserved 2025-04-17 | Published 2025-09-08 | Updated 2025-09-09 | Assigner Liferay




MEDIUM: 4.8CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Problem types

CWE-918 Server-Side Request Forgery (SSRF)

Product status

Default status
unaffected

7.4.0 (maven)
affected

Default status
unaffected

2024.Q1.1 (maven)
affected

2024.Q2.0 (maven)
affected

2024.Q3.0 (maven)
affected

2024.Q4.0 (maven)
affected

References

liferay.dev/...-/asset_publisher/jekt/content/CVE-2025-43763

cve.org (CVE-2025-43763)

nvd.nist.gov (CVE-2025-43763)

Download JSON