CVE-2025-4655 — Server-Side Request Forgery in Digital Experience Platform

CWE-918 — Server-Side Request Forgery4 documents4 sources
Severity
2.0LOWNVD
EPSS
0.0%
top 88.14%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Liferay Digital Experience PlatformLiferay DXPLiferay Portal+1 more
Timeline
PublishedAug 9

Description

SSRF vulnerability in FreeMarker templates in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, 7.4 GA through update 92 allows template editors to bypass access validations via crafted URLs.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N

Affected Packages4 packages

▶CVEListV5liferay/portal7.4.0 — 7.4.3.132
▶NVDliferay/liferay_portal7.4.0 — 7.4.3.132
▶NVDliferay/digital_experience_platform2024.Q1.1 — 2024.Q1.16+5
▶CVEListV5liferay/dxp7.4.13 — 7.4.13-u92+5

🔴Vulnerability Details

3
OSV
Liferay Portal and Liferay DXP vulnerable to Server-Side Request Forgery↗2025-08-09
▶
GHSA
Liferay Portal and Liferay DXP vulnerable to Server-Side Request Forgery↗2025-08-09
▶
CVEList
CVE-2025-4655: SSRF vulnerability in FreeMarker templates in Liferay Portal 7↗2025-08-09
▶
CVE-2025-4655 — Server-Side Request Forgery | cvebase