CVE-2025-43747

Liferay / DXP PUBLISHED

Description (CNA)

A server-side request forgery (SSRF) vulnerability exists in the Liferay DXP 2025.Q2.0 through 2025.Q2.3 due to insecure domain validation on analytics.cloud.domain.allowed, allowing an attacker to perform requests by change the domain and bypassing the validation method, this insecure validation is not distinguishing between trusted subdomains and malicious domains.

Affected (CNA)

Vendor / product	Versions
Liferay / DXP	affected 2025.Q2.0 through 2025.Q2.3

CWE

CWE-918

References

https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43747

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.