← Back

CVE-2025-4581

nvd nist
Published: Aug 9, 2025Modified: Dec 16, 2025

JSON object

Loading...
5.3
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Show more
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less
Source: security@liferay.com (Secondary)

Description

Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4 ,2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, 7.4 GA through update 92 allows a pre-authentication blind SSRF vulnerability in the portal-settings-authentication-opensso-web due to improper validation of user-supplied URLs. An attacker can exploit this issue to force the server to make arbitrary HTTP requests to internal systems, potentially leading to internal network enumeration or further exploitation.

Affected (7)

Liferay
2 products
Digital Experience Platform
Liferay Portal
Configuration A
7 vulnerable
Vulnerable SoftwareAffected Versions
Liferay
Digital Experience Platform
From 2024.q1.1 to 2024.q1.15
Digital Experience Platform
From 2024.q2.0 to 2024.q2.13
Digital Experience Platform
From 2024.q3.1 to 2024.q3.13
Digital Experience Platform
From 2024.q4.0 to 2024.q4.7
Digital Experience Platform
From 2025.q1.0 to 2025.q1.4
Digital Experience Platform
Version 7.4
Liferay Portal
From 7.4.0 to 7.4.3.132

Related CWEs

CWE-918
Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References (1)

Source: security@liferay.com
Vendor Advisory

Timeline

No history available yet.