CVE-2025-43763CWE-918ssrf

CVE-2025-43763

Medium · published September 9, 2025

CVSS v3.1
6.5
EPSS
0%
Percentile
8.8
In the wild
Unconfirmed
What it is

A server-side request forgery (SSRF) vulnerability exist in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13 and 2024.Q1.1 through 2024.Q1.20 that affects custom object attachment fields. This flaw allows an attacker to manipulate the application into making unauthorized requests to other instances, creating new object entries that link to external resources.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00196 · 8.8th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2025-09-09T04:15Z
Affected products (5)
ProductVersionsFixed in
liferay/digital_experience_platform≥ 2024.q1.1, < 2024.q1.212024.q1.21
liferay/digital_experience_platform≥ 2024.q2.0, ≤ 2024.q2.13—
liferay/digital_experience_platform≥ 2024.Q3.0, ≤ 2024.Q3.13—
liferay/digital_experience_platform≥ 2024.q4.0, ≤ 2024.q4.7—
liferay/liferay_portal≥ 7.4.0, < 7.4.3.1327.4.3.132
References (1)
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43763 · [email protected]
EPSS history
Timeline
  • 08 SEP 23:24Z
    A server-side request forgery (SSRF) vulnerability exist in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0…
    cvelistv5