GitHub Advisoryadvisory · Maven

GHSA-477q-x55m-j38g Liferay Portal is vulnerable to SSRF through custom object attachment fields

MEDIUM Published 2025-09-09 Modified 2025-09-10 Official page ↗
Aliases
CVE-2025-43763
Ecosystem
Maven
Packages
com.liferay:com.liferay.object.service
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Weaknesses
CWE-918
Reviewed
2025-09-10

Affected packages

• Maven com.liferay:com.liferay.object.service: < 1.0.208 → fixed in 1.0.208

Description

A server-side request forgery (SSRF) vulnerability exist in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13 and 2024.Q1.1 through 2024.Q1.20 that affects custom object attachment fields. This flaw allows an attacker to manipulate the application into making unauthorized requests to other instances, creating new object entries that link to external resources.

Related

Alias · CVE (1)

  • CVE-2025-43763 A server-side request forgery (SSRF) vulnerability exist in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through… vulnerability

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References