{"id":"CVE-2025-4581","published":"2025-08-09T04:14:22Z","modified":"2025-08-11T18:52:32Z","title":"Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4 ,2024.Q4.0 through 2024.Q4.7…","vendor":"Liferay","product":"Portal","tier":"core","eol":null,"affectedVersions":[{"vendor":"Liferay","product":"Portal","versions":[">= 7.4.0, <= 7.4.3.132"]},{"vendor":"Liferay","product":"DXP","versions":[">= 7.4.13, <= 7.4.13-u92",">= 2024.Q1.1, <= 2024.Q1.15",">= 2024.Q2.0, <= 2024.Q2.13",">= 2024.Q3.1, <= 2024.Q3.13",">= 2024.Q4.0, <= 2024.Q4.7",">= 2025.Q1.0, <= 2025.Q1.4"]}],"description":{"text":"Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4 ,2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, 7.4 GA through update 92 allows a pre-authentication blind SSRF vulnerability in the portal-settings-authentication-opensso-web due to improper validation of user-supplied URLs. An attacker can exploit this issue to force the server to make arbitrary HTTP requests to internal systems, potentially leading to internal network enumeration or further exploitation.","provenance":"source","from":"CVE.org"},"summary":null,"cvss":{"score":5.3,"severity":"MEDIUM","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00473,"percentile":0.40936,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2025-07-13","exploitedFirstSeen":"2025-11-20","ransomware":false,"evidence":[{"url":"https://isc.sans.edu/diary/rss/32506","date":"2025-11-20"}],"evidenceTotal":1,"provenance":"source"},"exploited":true,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[{"id":"CWE-918","name":"Server-Side Request Forgery"}],"references":[{"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-4581","tags":[]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Maven","package":"com.liferay.portal:release.portal.bom","vulnerableRanges":[">=7.4.0, <=7.4.3.132"],"patched":[],"from":["GHSA-6v93-frf9-2rp8"],"provenance":"source"},{"ecosystem":"Maven","package":"com.liferay.portal:release.dxp.bom","vulnerableRanges":[">=2025.Q1.0, <2025.Q1.5",">=2024.Q4.0, <=2024.Q4.7",">=2024.Q3.1, <=2024.Q3.13",">=2024.Q2.0, <=2024.Q2.13",">=2024.Q1.0, <2024.Q1.16","<=7.4.13.u92"],"patched":["2025.Q1.5","2024.Q1.16"],"from":["GHSA-6v93-frf9-2rp8"],"provenance":"source"}],"advisories":[{"id":"GHSA-6v93-frf9-2rp8","url":"https://github.com/advisories/GHSA-6v93-frf9-2rp8","severity":"MODERATE","ecosystem":"Maven","package":"com.liferay.portal:release.portal.bom","vulnerableRanges":[">=7.4.0, <=7.4.3.132"],"patched":[],"provenance":"source","from":"GHSA"},{"id":"GHSA-6v93-frf9-2rp8","url":"https://github.com/advisories/GHSA-6v93-frf9-2rp8","severity":"MODERATE","ecosystem":"Maven","package":"com.liferay.portal:release.dxp.bom","vulnerableRanges":[">=2025.Q1.0, <2025.Q1.5"],"patched":["2025.Q1.5"],"provenance":"source","from":"GHSA"},{"id":"GHSA-6v93-frf9-2rp8","url":"https://github.com/advisories/GHSA-6v93-frf9-2rp8","severity":"MODERATE","ecosystem":"Maven","package":"com.liferay.portal:release.dxp.bom","vulnerableRanges":[">=2024.Q4.0, <=2024.Q4.7"],"patched":[],"provenance":"source","from":"GHSA"},{"id":"GHSA-6v93-frf9-2rp8","url":"https://github.com/advisories/GHSA-6v93-frf9-2rp8","severity":"MODERATE","ecosystem":"Maven","package":"com.liferay.portal:release.dxp.bom","vulnerableRanges":[">=2024.Q3.1, <=2024.Q3.13"],"patched":[],"provenance":"source","from":"GHSA"},{"id":"GHSA-6v93-frf9-2rp8","url":"https://github.com/advisories/GHSA-6v93-frf9-2rp8","severity":"MODERATE","ecosystem":"Maven","package":"com.liferay.portal:release.dxp.bom","vulnerableRanges":[">=2024.Q2.0, <=2024.Q2.13"],"patched":[],"provenance":"source","from":"GHSA"},{"id":"GHSA-6v93-frf9-2rp8","url":"https://github.com/advisories/GHSA-6v93-frf9-2rp8","severity":"MODERATE","ecosystem":"Maven","package":"com.liferay.portal:release.dxp.bom","vulnerableRanges":[">=2024.Q1.0, <2024.Q1.16"],"patched":["2024.Q1.16"],"provenance":"source","from":"GHSA"},{"id":"GHSA-6v93-frf9-2rp8","url":"https://github.com/advisories/GHSA-6v93-frf9-2rp8","severity":"MODERATE","ecosystem":"Maven","package":"com.liferay.portal:release.dxp.bom","vulnerableRanges":["<=7.4.13.u92"],"patched":[],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2025-24041","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-24041","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2025-08-09","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2025-4581","provenance":"source"},{"date":"2025-11-20","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://isc.sans.edu/diary/rss/32506","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":46.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 475 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":8.19,"detail":"percentile 0.4094"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":3.71,"detail":"base score 5.3"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"packageHistory":[{"cve":"CVE-2025-2536","published":"2025-03-19","fixed":"2024.Q4.0","kev":false},{"cve":"CVE-2025-3760","published":"2025-04-17","fixed":"2025.Q1.0","kev":false},{"cve":"CVE-2025-43734","published":"2025-08-12","fixed":"2025.q1.11","kev":false,"link":{"from":"CVE-2025-4581","to":"CVE-2025-43734","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:com.liferay.portal:release.dxp.bom","fromFixed":"2024.Q1.16","toFixed":"2024.q1.17","daysApart":3}]}},{"cve":"CVE-2025-4581","published":"2025-08-09","fixed":"2025.Q1.5","kev":false},{"cve":"CVE-2025-4655","published":"2025-08-09","fixed":"2025.Q1.6","kev":false,"link":{"from":"CVE-2025-4581","to":"CVE-2025-4655","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:com.liferay.portal:release.dxp.bom","fromFixed":"2025.Q1.5","toFixed":"2025.Q1.6","daysApart":0}]}},{"cve":"CVE-2025-43736","published":"2025-08-12","fixed":"2025.Q1.9","kev":false,"link":{"from":"CVE-2025-4581","to":"CVE-2025-43736","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:com.liferay.portal:release.dxp.bom","fromFixed":"2024.Q1.16","toFixed":"2024.Q1.17","daysApart":3}]}},{"cve":"CVE-2025-43776","published":"2025-09-09","fixed":"2025.Q2.10","kev":false}],"package":"Maven:com.liferay.portal:release.dxp.bom"}}