1. Home
  2. CVE Database
  3. CVE-2025-43747
MEDIUM · 6.5

CVE-2025-43747

A server-side request forgery (SSRF) vulnerability exists in the Liferay DXP 2025.Q2.0 through 2025.Q2.3 due to insecure domain validation on analytics.cloud.domain.allowed, allowing an attacker to pe...

Vulnerability Description

A server-side request forgery (SSRF) vulnerability exists in the Liferay DXP 2025.Q2.0 through 2025.Q2.3 due to insecure domain validation on analytics.cloud.domain.allowed, allowing an attacker to perform requests by change the domain and bypassing the validation method, this insecure validation is not distinguishing between trusted subdomains and malicious domains.

CVSS Score

6.5

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
LOW
Integrity
LOW
Availability
NONE

Affected Products

VendorProductVersions
LiferayDigital Experience Platform>= 2025.Q2.0, < 2025.Q2.4

Related Weaknesses (CWE)

CWE-918

References

FAQ

What is CVE-2025-43747?

CVE-2025-43747 is a vulnerability with a CVSS score of 6.5 (MEDIUM). A server-side request forgery (SSRF) vulnerability exists in the Liferay DXP 2025.Q2.0 through 2025.Q2.3 due to insecure domain validation on analytics.cloud.domain.allowed, allowing an attacker to pe...

How severe is CVE-2025-43747?

CVE-2025-43747 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2025-43747?

Check the references section above for vendor advisories and patch information. Affected products include: Liferay Digital Experience Platform.