Description

A server-side request forgery (SSRF) vulnerability exists in the Liferay DXP 2025.Q2.0 through 2025.Q2.3 due to insecure domain validation on analytics.cloud.domain.allowed, allowing an attacker to perform requests by change the domain and bypassing the validation method, this insecure validation is not distinguishing between trusted subdomains and malicious domains.

Remediation

References

CVE-2025-43747

Related Vulnerabilities

Magento Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2019-7865)

WordPress Plugin Yakadanda Google+ Hangout Events Cross-Site Scripting (0.3.7)

Contao Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2021-35955)

WordPress Plugin Import any XML or CSV File to WordPress Arbitrary File Upload (3.2.3)

Oracle Database Server CVE-2011-0799 Vulnerability (CVE-2011-0799)

Severity

Medium

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities CWE-918 CVE-2025-43747