PT-2025-34298 · Liferay · Liferay Dxp

Published 2025-08-21 · Updated 2025-08-22 · CVE-2025-43747

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Liferay DXP versions 2025.Q2.0 through 2025.Q2.3

Description: A server-side request forgery (SSRF) vulnerability exists due to insecure domain validation on analytics.cloud.domain.allowed. This allows an attacker to perform requests by changing the domain and bypassing the validation method, as the validation does not distinguish between trusted subdomains and malicious domains.

Recommendations: Liferay DXP version 2025.Q2.3 Liferay DXP version 2025.Q2.2 Liferay DXP version 2025.Q2.1 Liferay DXP version 2025.Q2.0

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-43747

Affected Products

Liferay Dxp

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-43747 · Security Note
• https://osv.dev/vulnerability/CVE-2025-43747 · Vendor Advisory
• https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43747 · Vendor Advisory
• https://twitter.com/CVEnew/status/1958659335955128783 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1958686076962288107 · Twitter Post
• https://t.me/CVEtracker/30644 · Telegram Post