IT-Sentinel

« BACK_TO_HOME

PUBLISHED

2025-08-09 05:15

MODIFIED

2025-08-11 18:32

EPSS (Prob. Exploit)

0.23%

Top 87.3%

DATA SOURCES:

NVD 🔗 2025-10-18 CVE PROJECT 🔗 2026-01-19 FIRST EPSS 🔗 2026-10-25 GITHUB 🔗 2026-11-04 OSV 🔗 2026-09-20

> DESCRIPTION

SSRF vulnerability in FreeMarker templates in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, 7.4 GA through update 92 allows template editors to bypass access validations via crafted URLs.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> GITHUB SECURITY ADVISORY

GHSA-72qj-48g4-5xgx MODERATE

JRuby-OpenSSL has hostname verification disabled by default

AFFECTED PACKAGES:

RUBYGEMS / jruby-openssl

>= 0.12.1, < 0.15.4

Fixed in: 0.15.4

MAVEN / org.jruby:jruby

>= 9.3.4.0, < 9.4.12.1

Fixed in: 9.4.12.1

MAVEN / org.jruby:jruby

>= 10.0.0.0, < 10.0.0.1

Fixed in: 10.0.0.1

MAVEN / rubygems:jruby-openssl

>= 0.12.1, < 0.15.4

Fixed in: 0.15.4

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

AFFECTED PACKAGES:

Unknown / Unknown

10 versions affected

ALIASES:

GHSA-c6g5-g6r7-q4j6

> HISTORIQUE DES MODIFICATIONS

Première apparition

09/08/2025 05:15

Source: NVD

📊 ENRICHISSEMENT 18/10/2025 15:07

CVEPROJECT

Champ modifié: CVE Project

Ancienne valeur:

Non

Nouvelle valeur:

Oui