CVE-2025-43763: SSRF
A server-side request forgery (SSRF) vulnerability exist in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13 and 2024.Q1.1 through 2024.Q1.20 that affects custom object attachment fields. This flaw allows an attacker to manipulate the application into making unauthorized requests to other instances, creating new object entries that link to external resources.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-43763?
CVE-2025-43763 is considered a high-risk vulnerability due to its potential for server-side request forgery exploits.
How do I fix CVE-2025-43763?
To fix CVE-2025-43763, update Liferay Portal to version 7.4.3.132 or later, and Liferay DXP to versions beyond the affected ranges.
What software is affected by CVE-2025-43763?
CVE-2025-43763 affects Liferay Portal versions 7.4.0 to 7.4.3.131 and Liferay DXP versions across multiple quarterly releases up to 2024.Q4.7.
What type of vulnerability is CVE-2025-43763?
CVE-2025-43763 is categorized as a server-side request forgery (SSRF) vulnerability.
Can CVE-2025-43763 allow unauthorized access?
Yes, CVE-2025-43763 could potentially allow attackers to exploit internal resources, leading to unauthorized access.