CVE-2022-28977GHSA-W397-9P2J-6X23
HtmlUtil.escapeRedirect in Liferay Portal 7.3.1 through 7.4.2, and Liferay DXP 7.0 fix pack 91 through 101, 7.1 fix pack 17 through 25, 7.2
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 7.4.3.4-ga4, 7.0.10.fp101, 7.1.10.fp25, 7.2.10.fp14, 7.9.0
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
CISA's decision points: whether it is exploited, whether attacks can be automated, and how much control an attacker gets. Assessed (SSVC 2.0.3).What do these mean? →
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
HtmlUtil.escapeRedirect in Liferay Portal 7.3.1 through 7.4.2, and Liferay DXP 7.0 fix pack 91 through 101, 7.1 fix pack 17 through 25, 7.2 fix pack 5 through 14, and 7.3 before service pack 3 can be circumvented by using multiple forward slashes, which allows remote attackers to redirect users to arbitrary external URLs via the (1) 'redirect` parameter (2) `FORWARD_URL` parameter, and (3) others parameters that rely on HtmlUtil.escapeRedirect.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- n/a n/a
Version range not reported
- com.liferay.portal:release.portal.bomMaven
From 7.3.1-ga2 · fixed in 7.4.3.4-ga4
- com.liferay.portal:release.dxp.bomMaven
From 7.0.10.fp91 · fixed in 7.0.10.fp101
- com.liferay.portal:release.dxp.bomMaven
From 7.1.10.fp17 · fixed in 7.1.10.fp25
- com.liferay.portal:release.dxp.bomMaven
From 7.2.10.fp5 · fixed in 7.2.10.fp14
- com.liferay.portal:com.liferay.util.javaMaven
fixed in 7.9.0