Web Application Vulnerabilities Runtime SCA Findings
Looking for the vulnerability index of Invicti's legacy products?
Invicti Enterprise Acunetix Standard & Premium
Liferay DXP Server-Side Request Forgery (SSRF) Vulnerability (CVE-2025-43747) - Vulnerability Database

Liferay DXP Server-Side Request Forgery (SSRF) Vulnerability (CVE-2025-43747)

Description

A server-side request forgery (SSRF) vulnerability exists in the Liferay DXP 2025.Q2.0 through 2025.Q2.3 due to insecure domain validation on analytics.cloud.domain.allowed, allowing an attacker to perform requests by change the domain and bypassing the validation method, this insecure validation is not distinguishing between trusted subdomains and malicious domains.

References

CVE-2025-43747

Related Vulnerabilities

WebLogic CVE-2022-21258 Vulnerability (CVE-2022-21258) Medium
Common tags: Missing Update Known Vulnerabilities
SharePoint Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-1101) Medium
Common tags: Missing Update Known Vulnerabilities
Piwigo Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2020-19215) High
Common tags: Missing Update Known Vulnerabilities
Piwigo Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2020-19216) High
Common tags: Missing Update Known Vulnerabilities
Piwigo Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2020-19217) High
Common tags: Missing Update Known Vulnerabilities

Severity

Medium

Classification

CVE-2025-43747
CWE-918
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Tags

Missing Update
Known Vulnerabilities