Description

SSRF vulnerability in FreeMarker templates in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, 7.4 GA through update 92 allows template editors to bypass access validations via crafted URLs.

Remediation

References

CVE-2025-4655

Related Vulnerabilities

Oracle Database Server CVE-2021-35576 Vulnerability (CVE-2021-35576)

WordPress Plugin YouTube Gallery-Best YouTube Video Gallery Cross-Site Scripting (3.2.1)

WordPress Plugin Japanized For WooCommerce Cross-Site Scripting (2.5.6)

Oracle Database Server CVE-2006-0266 Vulnerability (CVE-2006-0266)

Internet Information Services Other Vulnerability (CVE-2000-0457)

Severity

Medium

Classification

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Tags

Missing Update Known Vulnerabilities CWE-918 CVE-2025-4655