CVE-2022-28977

Katalog CVE

CVSS 6.1 · Medium EPSS 0,60%

Kerentanan URL Redirection to Untrusted Site ('Open Redirect') pada liferay digital experience platform, liferay dxp +1 lainnya. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

HtmlUtil.escapeRedirect in Liferay Portal 7.3.1 through 7.4.2, and Liferay DXP 7.0 fix pack 91 through 101, 7.1 fix pack 17 through 25, 7.2 fix pack 5 through 14, and 7.3 before service pack 3 can be circumvented by using multiple forward slashes, which allows remote attackers to redirect users to arbitrary external URLs via the (1) 'redirect` parameter (2) `FORWARD_URL` parameter, and (3) others parameters that rely on HtmlUtil.escapeRedirect.

Rincian

Terbit di NVD

22 September 2022

Terakhir diubah

9 Juli 2026

Status NVD

Modified

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-601: URL Redirection to Untrusted Site ('Open Redirect')

EPSS (30 hari)

0,60% peluang dieksploitasi; lebih tinggi dari 47,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-202... patch · advisory vendor