Liferay Portal versions 7.4.0 through 7.4.3.109 and certain older unsupported versions, as well as specific Liferay DXP versions, are vulnerable to DNS rebinding attacks. This vulnerability allows remote attackers to redirect users to arbitrary external URLs by exploiting the default redirect URL security setting. The issue can be mitigated by changing the redirect URL security from IP-based to domain-based validation. A fix is available in version 7.4.3.110.