Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2025-4655GHSA-C6G5-G6R7-Q4J6

SSRF vulnerability in FreeMarker templates in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 2025.Q1.6, 2024.Q1.16
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: none
  • Automatable: no
  • Technical impact: partial

Summary

SSRF vulnerability in FreeMarker templates in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, 7.4 GA through update 92 allows template editors to bypass access validations via crafted URLs.

Timeline

  1. CVE published
  2. CISA SSVC assessment

    Exploitation: none · Automatable: no · Technical impact: partial

  3. Record last updated

Affected versions

  • Liferay Portal

    From 7.4.0 · through 7.4.3.132

  • Liferay DXP

    From 7.4.13 · through 7.4.13-u92; From 2024.Q1.1 · through 2024.Q1.15; From 2024.Q2.0 · through 2024.Q2.13; From 2024.Q3.1 · through 2024.Q3.13; From 2024.Q4.0 · through 2024.Q4.7; From 2025.Q1.0 · through 2025.Q1.5

  • com.liferay.portal:release.portal.bomMaven

    From 7.4.0 · through 7.4.3.132

  • com.liferay.portal:release.dxp.bomMaven

    From 2025.Q1.0 · fixed in 2025.Q1.6

  • com.liferay.portal:release.dxp.bomMaven

    From 2024.Q4.0 · through 2024.Q4.7

  • com.liferay.portal:release.dxp.bomMaven

    From 2024.Q3.1 · through 2024.Q3.13

  • com.liferay.portal:release.dxp.bomMaven

    From 2024.Q2.0 · through 2024.Q2.13

  • com.liferay.portal:release.dxp.bomMaven

    From 2024.Q1.0 · fixed in 2024.Q1.16

  • com.liferay.portal:release.dxp.bomMaven

    through 7.4.13.u92

References 1

liferay.dev