CVE-2025-43747

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-08-21 · updated 2026-06-17
Weakness: CWE-918

Description

A server-side request forgery (SSRF) vulnerability exists in the Liferay DXP 2025.Q2.0 through 2025.Q2.3 due to insecure domain validation on analytics.cloud.domain.allowed, allowing an attacker to perform requests by change the domain and bypassing the validation method, this insecure validation is not distinguishing between trusted subdomains and malicious domains.

Affected products

Liferay Digital Experience Platform: from 2025.Q2.0 before 2025.Q2.4 — fixed in 2025.Q2.4

How to fix

Upgrade to a fixed version: Liferay Digital Experience Platform 2025.Q2.4. Check the vendor advisory for mitigations.

References

https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43747

Get alerted when CVE-2025-43747 or the next vulnerability affects your stack