CVE-2025-4581 is a pre-authentication blind Server-Side Request Forgery (SSRF) vulnerability affecting Liferay Portal versions 7.4.0 through 7.4.3.132 and various Liferay DXP versions. This critical flaw, with a CVSS score of 8.6 (HIGH), allows an unauthenticated attacker to force the server to make arbitrary HTTP requests to internal systems due to improper validation of user-supplied URLs. This could lead to internal network enumeration or further exploitation. While there is no known active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered some community discussion and media coverage, indicating awareness.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 2024.q1.1, <= 2024.q1.15CPE matchmatch criteria | cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:* | ||
>= 2024.q2.0, <= 2024.q2.13CPE matchmatch criteria | cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:* | ||
>= 2024.q3.1, <= 2024.q3.13CPE matchmatch criteria | cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:* | ||
>= 2024.q4.0, <= 2024.q4.7CPE matchmatch criteria | cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:* | ||
>= 2025.q1.0, <= 2025.q1.4CPE matchmatch criteria | cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:* |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.