Description

Liferay XMLRPC servlet allows remote attackers to interact with internal network resources via Blind Server Side Request Forgery (SSRF). Consult Web References for more information about this problem.

Remediation

Restrict access to the vulnerable endpoints.

References

SSRF VS. BUSINESS-CRITICAL APPLICATIONS

SSRF bible. Cheatsheet

Related Vulnerabilities

WordPress Plugin MobiLoud-WordPress Mobile Apps-Convert your WordPress Website to Native Mobile Apps Remote Code Execution (4.0.1)

Apache OFBiz RCE (CVE-2024-45195)

Joomla! JCE arbitrary file upload

Node.js Debugger Unauthorized Access Vulnerability

Apache Solr Deserialization of untrusted data via jmx.serviceUrl

Severity

Medium

Classification

CWE-918 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Tags

Code Execution Acumonitor SSRF