Servers and applications

CVE-2025-4581

Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4 ,2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, 7.4 GA through update 92 allows a pre-authentication blind SSRF vulnerability in the portal-settings-authentication-opensso-web due to improper validation of user-supplied URLs. An attacker can…

Severity: Medium 5.3
Published: 9 Aug 2025
Last changed: 17 Jun 2026
Added to UpHeron: 1 Nov 2026
Sources: NVD

Affected software

Software	Affected versions
Liferay Portal / DXPServers and applications · `cpe:a:liferay:digital_experience_platform`	Version 7.4 From 2024.q1.1 up to 2024.q1.15 From 2024.q2.0 up to 2024.q2.13 From 2024.q3.1 up to 2024.q3.13 From 2024.q4.0 up to 2024.q4.7 From 2025.q1.0 up to 2025.q1.4
Liferay Portal / DXPServers and applications · `cpe:a:liferay:liferay_portal`	From 7.4.0 up to 7.4.3.132

References

NVD https://nvd.nist.gov/vuln/detail/CVE-2025-4581
CVE.org https://www.cve.org/CVERecord?id=CVE-2025-4581