What is GHSA-477q-x55m-j38g?

GHSA-477q-x55m-j38g is a security advisory published by GitHub Security Advisories with Medium severity. Liferay Portal is vulnerable to SSRF through custom object attachment fields

Which CVE IDs does GHSA-477q-x55m-j38g cover?

GHSA-477q-x55m-j38g covers the following CVE IDs: CVE-2025-43763. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-477q-x55m-j38g?

GHSA-477q-x55m-j38g affects 1 product, including: maven/com.liferay:com.liferay.object.service:\u003c 1.0.208.

GHSA-477q-x55m-j38gMedium

Liferay Portal is vulnerable to SSRF through custom object attachment fields

Vendor

GitHub Security Advisories

Published

September 9, 2025

Last Modified

September 10, 2025

🔗 CVE IDs covered (1)

CVE-2025-43763 →

📋 Description

A server-side request forgery (SSRF) vulnerability exist in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13 and 2024.Q1.1 through 2024.Q1.20 that affects custom object attachment fields. This flaw allows an attacker to manipulate the application into making unauthorized requests to other instances, creating new object entries that link to external resources.

🎯 Affected products1

maven/com.liferay:com.liferay.object.service:< 1.0.208

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2025-43763
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43763
https://github.com/liferay/liferay-portal/commit/0adf32842d055f40accc8b341c4feb11a9728261
https://github.com/liferay/liferay-portal/commit/e5fe3f9e9916e66a896e7c321e641c6eabbf4dae
https://liferay.atlassian.net/browse/LPE-18182
https://github.com/advisories/GHSA-477q-x55m-j38g