Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4 ,2024.Q4.0 through 2024.Q4.7…
Liferay · Portal
Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4 ,2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, 7.4 GA through update 92 allows a pre-authentication blind SSRF vulnerability in the portal-settings-authentication-opensso-web due to improper validation of user-supplied URLs. An attacker can exploit this issue to force the server to make arbitrary HTTP requests to internal systems, potentially leading to internal network enumeration or further exploitation.
- Exploited
- Yes, in VulnCheck KEV
- Reports
- 0
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
First seen exploited 3 months after disclosure.
- Disclosedday 0
- First seen exploitedVulnCheck KEV evidence+3 mo
Patch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.
7 fixes in release.dxp.bom over 6 months. The latest fix listed for release.dxp.bom is 2025.Q2.10.
Fixes in release.dxp.bomMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.
- 2024.Q4.0CVE-2025-253619 Mar 2025
- 2025.Q1.0CVE-2025-376017 Apr 2025
- 2025.Q1.5CVE-2025-45819 Aug 2025
- 2025.Q1.6CVE-2025-46559 Aug 2025
- 2025.Q1.9CVE-2025-4373612 Aug 2025
- 2025.q1.11CVE-2025-4373412 Aug 2025
- 2025.Q2.10CVE-2025-437769 Sep 2025Latest listed
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
Am I affected? What do I upgrade to?
From GitHub Security Advisories and OSV2 packages in 1 ecosystem. No single main package: each of these ships the affected code.
- Mavencom.liferay.portal:release.dxp.bomAffected: 2025.Q1.0 up to 2025.Q1.5; 2024.Q4.0 through 2024.Q4.7; 2024.Q3.1 through 2024.Q3.13; 2024.Q2.0 through 2024.Q2.13; 2024.Q1.0 up to 2024.Q1.16; 7.4.13.u92 and earlierUpgrade to 2025.Q1.5 or later (older lines: 2024.Q1.16)
- Mavencom.liferay.portal:release.portal.bomAffected: 7.4.0 through 7.4.3.132No fixed version published