CVE-2025-43763
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
A server-side request forgery (SSRF) vulnerability exists in Liferay Portal 7.4.0 through 7.4.3.131 and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, and 2024.Q1.1 through 2024.Q1.20 affecting custom object attachment fields. This flaw allows an attacker to manipulate the application into making unauthorized requests to other instances, creating new object entries that link to external resources.
Risk Assessment
An attacker can leverage the application to make unauthorized requests to internal or external resources, potentially leading to data leakage or unexpected actions.
Recommendation
Update Liferay Portal/DXP to a patched version or restrict the ability to create custom object attachment fields.
Other vulnerabilities in Liferay Portal/DXP
See all- CVE-2025-43773Critical
Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP in the listed versions has a security vulnerability allowing improper access through the expandoTableLocalService. This may allow unauthorized access to data or functions.
- CVE-2025-62275Medium
Blogs in Liferay Portal 7.4.0 through 7.4.3.111 and older unsupported versions, as well as Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92 and older unsupported versions, do not check permissions for images in a blog entry. This allows remote attackers to view images in a blog entry via a crafted URL.
- CVE-2025-62276Medium
The Document Library and Adaptive Media modules in Liferay Portal 7.4.0 through 7.4.3.111 and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92 and older unsupported versions use an incorrect cache-control header. This allows local users to obtain access to downloaded files via the browser's cache.
- CVE-2025-62261Medium
Liferay Portal 7.4.0 through 7.4.3.99 and older unsupported versions, as well as Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 34 and older unsupported versions, store password reset tokens in plain text. This allows attackers with database access to obtain the token, reset a user's password, and take over the account.
- CVE-2025-62256Medium
Liferay Portal 7.4.0 through 7.4.3.109, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.7, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions do not properly restrict access to OpenAPI in certain circumstances, allowing remote attackers to access the OpenAPI YAML file via a crafted URL.
Original NVD description (English source)
A server-side request forgery (SSRF) vulnerability exist in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13 and 2024.Q1.1 through 2024.Q1.20 that affects custom object attachment fields. This flaw allows an attacker to manipulate the application into making unauthorized requests to other instances, creating new object entries that link to external resources.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS