deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-cg99-m88x-422c
Package: com.liferay:com.liferay.users.admin.web (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: < 11.0.27
Patched in: 11.0.27

Summary: Liferay Portal and Liferay DXP have a Denial Of Service via File Upload (DOS) vulnerability

Details:
A Denial Of Service via File Upload (DOS) vulnerability in Liferay Portal 7.4.3.0 through 7.4.3.132, Liferay DXP 2025.Q1.0 through 2025.Q1.8, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allows a user to upload a profile picture of more than 300kb into a user profile. This size is more than the noted max 300kb size. This extra data can significantly slow down the Liferay service.
GitHub Security Advisory: GHSA-cg99-m88x-422c
Package: com.liferay:com.liferay.image.uploader.web (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: < 5.0.56
Patched in: 5.0.56

Summary: Liferay Portal and Liferay DXP have a Denial Of Service via File Upload (DOS) vulnerability

Details:
A Denial Of Service via File Upload (DOS) vulnerability in Liferay Portal 7.4.3.0 through 7.4.3.132, Liferay DXP 2025.Q1.0 through 2025.Q1.8, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allows a user to upload a profile picture of more than 300kb into a user profile. This size is more than the noted max 300kb size. This extra data can significantly slow down the Liferay service.
GitHub Security Advisory: GHSA-cg99-m88x-422c
Package: com.liferay:com.liferay.frontend.taglib (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: < 13.10.0
Patched in: 13.10.0

Summary: Liferay Portal and Liferay DXP have a Denial Of Service via File Upload (DOS) vulnerability

Details:
A Denial Of Service via File Upload (DOS) vulnerability in Liferay Portal 7.4.3.0 through 7.4.3.132, Liferay DXP 2025.Q1.0 through 2025.Q1.8, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allows a user to upload a profile picture of more than 300kb into a user profile. This size is more than the noted max 300kb size. This extra data can significantly slow down the Liferay service.
GitHub Security Advisory: GHSA-cg99-m88x-422c
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: <= 7.4.13.u92
Patched in: unpatched

Summary: Liferay Portal and Liferay DXP have a Denial Of Service via File Upload (DOS) vulnerability

Details:
A Denial Of Service via File Upload (DOS) vulnerability in Liferay Portal 7.4.3.0 through 7.4.3.132, Liferay DXP 2025.Q1.0 through 2025.Q1.8, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allows a user to upload a profile picture of more than 300kb into a user profile. This size is more than the noted max 300kb size. This extra data can significantly slow down the Liferay service.
GitHub Security Advisory: GHSA-cg99-m88x-422c
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: >= 2024.Q1.0, <= 2024.Q1.16
Patched in: 2024.Q1.17

Summary: Liferay Portal and Liferay DXP have a Denial Of Service via File Upload (DOS) vulnerability

Details:
A Denial Of Service via File Upload (DOS) vulnerability in Liferay Portal 7.4.3.0 through 7.4.3.132, Liferay DXP 2025.Q1.0 through 2025.Q1.8, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allows a user to upload a profile picture of more than 300kb into a user profile. This size is more than the noted max 300kb size. This extra data can significantly slow down the Liferay service.
GitHub Security Advisory: GHSA-cg99-m88x-422c
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: >= 2024.Q2.0, <= 2024.Q2.13
Patched in: unpatched

Summary: Liferay Portal and Liferay DXP have a Denial Of Service via File Upload (DOS) vulnerability

Details:
A Denial Of Service via File Upload (DOS) vulnerability in Liferay Portal 7.4.3.0 through 7.4.3.132, Liferay DXP 2025.Q1.0 through 2025.Q1.8, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allows a user to upload a profile picture of more than 300kb into a user profile. This size is more than the noted max 300kb size. This extra data can significantly slow down the Liferay service.
GitHub Security Advisory: GHSA-cg99-m88x-422c
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: >= 2024.Q3.0, <= 2024.Q3.13
Patched in: unpatched

Summary: Liferay Portal and Liferay DXP have a Denial Of Service via File Upload (DOS) vulnerability

Details:
A Denial Of Service via File Upload (DOS) vulnerability in Liferay Portal 7.4.3.0 through 7.4.3.132, Liferay DXP 2025.Q1.0 through 2025.Q1.8, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allows a user to upload a profile picture of more than 300kb into a user profile. This size is more than the noted max 300kb size. This extra data can significantly slow down the Liferay service.
GitHub Security Advisory: GHSA-cg99-m88x-422c
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: >= 2024.Q4.0, <= 2024.Q4.7
Patched in: unpatched

Summary: Liferay Portal and Liferay DXP have a Denial Of Service via File Upload (DOS) vulnerability

Details:
A Denial Of Service via File Upload (DOS) vulnerability in Liferay Portal 7.4.3.0 through 7.4.3.132, Liferay DXP 2025.Q1.0 through 2025.Q1.8, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allows a user to upload a profile picture of more than 300kb into a user profile. This size is more than the noted max 300kb size. This extra data can significantly slow down the Liferay service.
GitHub Security Advisory: GHSA-cg99-m88x-422c
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: >= 2025.Q1.0, <= 2025.Q1.8
Patched in: 2025.Q1.9

Summary: Liferay Portal and Liferay DXP have a Denial Of Service via File Upload (DOS) vulnerability

Details:
A Denial Of Service via File Upload (DOS) vulnerability in Liferay Portal 7.4.3.0 through 7.4.3.132, Liferay DXP 2025.Q1.0 through 2025.Q1.8, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allows a user to upload a profile picture of more than 300kb into a user profile. This size is more than the noted max 300kb size. This extra data can significantly slow down the Liferay service.
GitHub Security Advisory: GHSA-cg99-m88x-422c
Package: com.liferay.portal:release.portal.bom (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: >= 7.4.3.0, <= 7.4.3.132
Patched in: unpatched

Summary: Liferay Portal and Liferay DXP have a Denial Of Service via File Upload (DOS) vulnerability

Details:
A Denial Of Service via File Upload (DOS) vulnerability in Liferay Portal 7.4.3.0 through 7.4.3.132, Liferay DXP 2025.Q1.0 through 2025.Q1.8, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allows a user to upload a profile picture of more than 300kb into a user profile. This size is more than the noted max 300kb size. This extra data can significantly slow down the Liferay service.
GitHub Security Advisory: GHSA-67mf-3cr5-8w23
Package: org.bouncycastle:bctls-jdk18on (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: >= 1.0, < 1.78
Patched in: 1.78

Summary: Bouncy Castle for Java on All (API modules) allows Excessive Allocation

Details:
A resource allocation vulnerability exists in Bouncy Castle for Java (by Legion of the Bouncy Castle Inc.) that affects all API modules. The vulnerability allows attackers to cause excessive memory allocation through unbounded resource consumption, potentially leading to denial of service. The issue is located in the ASN1ObjectIdentifier.java file in the core module.

This issue affects Bouncy Castle for Java: from BC 1.0 through 1.77, from BC-FJA 1.0.0 through 2.0.0.
GitHub Security Advisory: GHSA-67mf-3cr5-8w23
Package: org.bouncycastle:bctls-jdk15to18 (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: >= 1.0, < 1.78
Patched in: 1.78

Summary: Bouncy Castle for Java on All (API modules) allows Excessive Allocation

Details:
A resource allocation vulnerability exists in Bouncy Castle for Java (by Legion of the Bouncy Castle Inc.) that affects all API modules. The vulnerability allows attackers to cause excessive memory allocation through unbounded resource consumption, potentially leading to denial of service. The issue is located in the ASN1ObjectIdentifier.java file in the core module.

This issue affects Bouncy Castle for Java: from BC 1.0 through 1.77, from BC-FJA 1.0.0 through 2.0.0.
GitHub Security Advisory: GHSA-67mf-3cr5-8w23
Package: org.bouncycastle:bctls-jdk14 (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: >= 1.0, < 1.78
Patched in: 1.78

Summary: Bouncy Castle for Java on All (API modules) allows Excessive Allocation

Details:
A resource allocation vulnerability exists in Bouncy Castle for Java (by Legion of the Bouncy Castle Inc.) that affects all API modules. The vulnerability allows attackers to cause excessive memory allocation through unbounded resource consumption, potentially leading to denial of service. The issue is located in the ASN1ObjectIdentifier.java file in the core module.

This issue affects Bouncy Castle for Java: from BC 1.0 through 1.77, from BC-FJA 1.0.0 through 2.0.0.
GitHub Security Advisory: GHSA-67mf-3cr5-8w23
Package: org.bouncycastle:bcprov-jdk18on (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: >= 1.0, < 1.78
Patched in: 1.78

Summary: Bouncy Castle for Java on All (API modules) allows Excessive Allocation

Details:
A resource allocation vulnerability exists in Bouncy Castle for Java (by Legion of the Bouncy Castle Inc.) that affects all API modules. The vulnerability allows attackers to cause excessive memory allocation through unbounded resource consumption, potentially leading to denial of service. The issue is located in the ASN1ObjectIdentifier.java file in the core module.

This issue affects Bouncy Castle for Java: from BC 1.0 through 1.77, from BC-FJA 1.0.0 through 2.0.0.
GitHub Security Advisory: GHSA-67mf-3cr5-8w23
Package: org.bouncycastle:bcprov-jdk15to18 (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: >= 1.0, < 1.78
Patched in: 1.78

Summary: Bouncy Castle for Java on All (API modules) allows Excessive Allocation

Details:
A resource allocation vulnerability exists in Bouncy Castle for Java (by Legion of the Bouncy Castle Inc.) that affects all API modules. The vulnerability allows attackers to cause excessive memory allocation through unbounded resource consumption, potentially leading to denial of service. The issue is located in the ASN1ObjectIdentifier.java file in the core module.

This issue affects Bouncy Castle for Java: from BC 1.0 through 1.77, from BC-FJA 1.0.0 through 2.0.0.
GitHub Security Advisory: GHSA-67mf-3cr5-8w23
Package: org.bouncycastle:bcprov-jdk14 (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: >= 1.0, < 1.78
Patched in: 1.78

Summary: Bouncy Castle for Java on All (API modules) allows Excessive Allocation

Details:
A resource allocation vulnerability exists in Bouncy Castle for Java (by Legion of the Bouncy Castle Inc.) that affects all API modules. The vulnerability allows attackers to cause excessive memory allocation through unbounded resource consumption, potentially leading to denial of service. The issue is located in the ASN1ObjectIdentifier.java file in the core module.

This issue affects Bouncy Castle for Java: from BC 1.0 through 1.77, from BC-FJA 1.0.0 through 2.0.0.
GitHub Security Advisory: GHSA-c6g5-g6r7-q4j6
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: <= 7.4.13.u92
Patched in: unpatched

Summary: Liferay Portal and Liferay DXP vulnerable to Server-Side Request Forgery

Details:
An SSRF vulnerability in FreeMarker templates in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, and 7.4 GA through update 92 allows template editors to bypass access validations via crafted URLs.
GitHub Security Advisory: GHSA-c6g5-g6r7-q4j6
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: >= 2024.Q1.0, <= 2024.Q1.15
Patched in: 2024.Q1.16

Summary: Liferay Portal and Liferay DXP vulnerable to Server-Side Request Forgery

Details:
An SSRF vulnerability in FreeMarker templates in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, and 7.4 GA through update 92 allows template editors to bypass access validations via crafted URLs.
GitHub Security Advisory: GHSA-c6g5-g6r7-q4j6
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: >= 2024.Q2.0, <= 2024.Q2.13
Patched in: unpatched

Summary: Liferay Portal and Liferay DXP vulnerable to Server-Side Request Forgery

Details:
An SSRF vulnerability in FreeMarker templates in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, and 7.4 GA through update 92 allows template editors to bypass access validations via crafted URLs.
GitHub Security Advisory: GHSA-c6g5-g6r7-q4j6
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: >= 2024.Q3.1, <= 2024.Q3.13
Patched in: unpatched

Summary: Liferay Portal and Liferay DXP vulnerable to Server-Side Request Forgery

Details:
An SSRF vulnerability in FreeMarker templates in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, and 7.4 GA through update 92 allows template editors to bypass access validations via crafted URLs.
GitHub Security Advisory: GHSA-c6g5-g6r7-q4j6
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: >= 2024.Q4.0, <= 2024.Q4.7
Patched in: unpatched

Summary: Liferay Portal and Liferay DXP vulnerable to Server-Side Request Forgery

Details:
An SSRF vulnerability in FreeMarker templates in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, and 7.4 GA through update 92 allows template editors to bypass access validations via crafted URLs.
GitHub Security Advisory: GHSA-c6g5-g6r7-q4j6
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: >= 2025.Q1.0, <= 2025.Q1.5
Patched in: 2025.Q1.6

Summary: Liferay Portal and Liferay DXP vulnerable to Server-Side Request Forgery

Details:
An SSRF vulnerability in FreeMarker templates in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, and 7.4 GA through update 92 allows template editors to bypass access validations via crafted URLs.
GitHub Security Advisory: GHSA-c6g5-g6r7-q4j6
Package: com.liferay.portal:release.portal.bom (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: >= 7.4.0, <= 7.4.3.132
Patched in: unpatched

Summary: Liferay Portal and Liferay DXP vulnerable to Server-Side Request Forgery

Details:
An SSRF vulnerability in FreeMarker templates in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, and 7.4 GA through update 92 allows template editors to bypass access validations via crafted URLs.
GitHub Security Advisory: GHSA-6v93-frf9-2rp8
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: <= 7.4.13.u92
Patched in: unpatched

Summary: Liferay Portal and Liferay DXP vulnerable to Server-Side Request Forgery

Details:
Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, and 7.4 GA through update 92 allow a pre-authentication blind SSRF vulnerability in the portal-settings-authentication-opensso-web component due to improper validation of user-supplied URLs. An attacker can exploit this issue to force the server to make arbitrary HTTP requests to internal systems, potentially leading to internal network enumeration or further exploitation.
GitHub Security Advisory: GHSA-6v93-frf9-2rp8
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: >= 2024.Q1.0, <= 2024.Q1.15
Patched in: 2024.Q1.16

Summary: Liferay Portal and Liferay DXP vulnerable to Server-Side Request Forgery

Details:
Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, and 7.4 GA through update 92 allow a pre-authentication blind SSRF vulnerability in the portal-settings-authentication-opensso-web component due to improper validation of user-supplied URLs. An attacker can exploit this issue to force the server to make arbitrary HTTP requests to internal systems, potentially leading to internal network enumeration or further exploitation.
GitHub Security Advisory: GHSA-6v93-frf9-2rp8
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: >= 2024.Q2.0, <= 2024.Q2.13
Patched in: unpatched

Summary: Liferay Portal and Liferay DXP vulnerable to Server-Side Request Forgery

Details:
Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, and 7.4 GA through update 92 allow a pre-authentication blind SSRF vulnerability in the portal-settings-authentication-opensso-web component due to improper validation of user-supplied URLs. An attacker can exploit this issue to force the server to make arbitrary HTTP requests to internal systems, potentially leading to internal network enumeration or further exploitation.
GitHub Security Advisory: GHSA-6v93-frf9-2rp8
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: >= 2024.Q3.1, <= 2024.Q3.13
Patched in: unpatched

Summary: Liferay Portal and Liferay DXP vulnerable to Server-Side Request Forgery

Details:
Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, and 7.4 GA through update 92 allow a pre-authentication blind SSRF vulnerability in the portal-settings-authentication-opensso-web component due to improper validation of user-supplied URLs. An attacker can exploit this issue to force the server to make arbitrary HTTP requests to internal systems, potentially leading to internal network enumeration or further exploitation.
GitHub Security Advisory: GHSA-6v93-frf9-2rp8
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: >= 2024.Q4.0, <= 2024.Q4.7
Patched in: unpatched

Summary: Liferay Portal and Liferay DXP vulnerable to Server-Side Request Forgery

Details:
Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, and 7.4 GA through update 92 allow a pre-authentication blind SSRF vulnerability in the portal-settings-authentication-opensso-web component due to improper validation of user-supplied URLs. An attacker can exploit this issue to force the server to make arbitrary HTTP requests to internal systems, potentially leading to internal network enumeration or further exploitation.
GitHub Security Advisory: GHSA-6v93-frf9-2rp8
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: >= 2025.Q1.0, <= 2025.Q1.4
Patched in: 2025.Q1.5

Summary: Liferay Portal and Liferay DXP vulnerable to Server-Side Request Forgery

Details:
Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, and 7.4 GA through update 92 allow a pre-authentication blind SSRF vulnerability in the portal-settings-authentication-opensso-web component due to improper validation of user-supplied URLs. An attacker can exploit this issue to force the server to make arbitrary HTTP requests to internal systems, potentially leading to internal network enumeration or further exploitation.