Description
A server-side request forgery (SSRF) vulnerability exists in the Liferay DXP 2025.Q2.0 through 2025.Q2.3 due to insecure domain validation on analytics.cloud.domain.allowed, allowing an attacker to perform requests by change the domain and bypassing the validation method, this insecure validation is not distinguishing between trusted subdomains and malicious domains.
Remediation
References
Related Vulnerabilities
WordPress Plugin oQey Gallery 'tbpv_domain' Parameter Cross-Site Scripting (0.2)
WordPress Plugin WP-Forum Multiple SQL Injection Vulnerabilities (1.7.8)
Envoy Proxy Improper Neutralization of Null Byte or NUL Character Vulnerability (CVE-2026-47778)
Dot CMS Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2017-11466)
WordPress Plugin 3D Slider Slice Box Multiple Cross-Site Scripting Vulnerabilities (1.0)