VYPR
← All advisories
Moderate severityNVD Advisory· Published Sep 8, 2025· Updated Sep 9, 2025

CVE-2025-43763

CVE-2025-43763

Description

A server-side request forgery (SSRF) vulnerability exist in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13 and 2024.Q1.1 through 2024.Q1.20 that affects custom object attachment fields. This flaw allows an attacker to manipulate the application into making unauthorized requests to other instances, creating new object entries that link to external resources.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
com.liferay:com.liferay.object.serviceMaven
< 1.0.2081.0.208

Affected products

2

Patches

2
0adf32842d05

LPD-43974 Fix validation, and add the same in the other method

https://github.com/liferay/liferay-portalCarlos CorreaJan 28, 2025via ghsa
commit
1 file changed · +2 −6
  • modules/apps/object/object-service/src/main/java/com/liferay/object/internal/field/attachment/AttachmentManagerImpl.java+2 −6 modified
    @@ -145,7 +145,7 @@ public FileEntry getOrAddFileEntry(
 			_dlAppLocalService.fetchFileEntryByExternalReferenceCode(
 				groupId, externalReferenceCode);
 
-		if (fileEntry != null) {
+		if (fileEntry != null && companyId == fileEntry.getCompanyId()) {
 			return fileEntry;
 		}
 
@@ -182,11 +182,7 @@ public FileEntry getOrAddFileEntry(
 			_dlAppLocalService.fetchFileEntryByExternalReferenceCode(
 				groupId, externalReferenceCode);
 
-		if (companyId != fileEntry.getCompanyId()) {
-			throw new NoSuchFileEntryException();
-		}
-
-		if (fileEntry != null) {
+		if (fileEntry != null && companyId == fileEntry.getCompanyId()) {
 			return fileEntry;
 		}
e5fe3f9e9916

LPD-43974 Check that file or folder belongs to company

https://github.com/liferay/liferay-portalJaime LeonJan 28, 2025via ghsa
commit
1 file changed · +10 −0
  • modules/apps/object/object-service/src/main/java/com/liferay/object/internal/field/attachment/AttachmentManagerImpl.java+10 −0 modified
    @@ -8,6 +8,8 @@
 import com.liferay.document.library.kernel.exception.FileExtensionException;
 import com.liferay.document.library.kernel.exception.FileNameException;
 import com.liferay.document.library.kernel.exception.FileSizeException;
+import com.liferay.document.library.kernel.exception.NoSuchFileEntryException;
+import com.liferay.document.library.kernel.exception.NoSuchFolderException;
 import com.liferay.document.library.kernel.model.DLFolder;
 import com.liferay.document.library.kernel.model.DLFolderConstants;
 import com.liferay.document.library.kernel.service.DLAppLocalService;
@@ -180,6 +182,10 @@ public FileEntry getOrAddFileEntry(
 			_dlAppLocalService.fetchFileEntryByExternalReferenceCode(
 				groupId, externalReferenceCode);
 
+		if (companyId != fileEntry.getCompanyId()) {
+			throw new NoSuchFileEntryException();
+		}
+
 		if (fileEntry != null) {
 			return fileEntry;
 		}
@@ -195,6 +201,10 @@ public FileEntry getOrAddFileEntry(
 				_dlFolderService.getDLFolderByExternalReferenceCode(
 					folderExternalReferenceCode, groupId);
 
+			if (dlFolder.getCompanyId() != companyId) {
+				throw new NoSuchFolderException();
+			}
+
 			repositoryId = dlFolder.getRepositoryId();
 			folderId = dlFolder.getFolderId();
 		}

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

6

News mentions

0

No linked articles in our index yet.