CVE-2022-28977
Last modified
CVE-2022-28977 is a medium-severity vulnerability rated 6.1/10 on the CVSS scale. HtmlUtil.escapeRedirect in Liferay Portal 7.3.1 through 7.4.2, and Liferay DXP 7.0 fix pack 91 through 101, 7.1 fix pack 17 through 25, 7.2 fix pack 5 through 14, and 7.3 before service pack 3 can be circumvented by using multiple forward slashes, which allows remote attackers to redirect users to arbitrary external URLs via the (1) 'redirect` parameter (2) `FORWARD_URL` parameter, and (3) others parameters that rely on HtmlUtil.escapeRedirect.. EPSS estimates a 0.45% chance of exploitation in the next 30 days.
Description
HtmlUtil.escapeRedirect in Liferay Portal 7.3.1 through 7.4.2, and Liferay DXP 7.0 fix pack 91 through 101, 7.1 fix pack 17 through 25, 7.2 fix pack 5 through 14, and 7.3 before service pack 3 can be circumvented by using multiple forward slashes, which allows remote attackers to redirect users to arbitrary external URLs via the (1) 'redirect` parameter (2) `FORWARD_URL` parameter, and (3) others parameters that rely on HtmlUtil.escapeRedirect.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Liferay | Digital Experience Platform | 7.0 |
| Liferay | Digital Experience Platform | 7.1 |
| Liferay | Digital Experience Platform | 7.2 |
| Liferay | Dxp | 7.3 |
| Liferay | Liferay Portal | >= 7.3.1, < 7.4.3.4 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-28977?
How severe is CVE-2022-28977?
How do I fix CVE-2022-28977?
How Strix Helps
- One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-2897Measuresoft ScadaPro Server and Client (All Versions) do not…7.8
- CVE-2022-28970Tenda AX1806 v1.0.0.1 was discovered to contain a heap overf…7.5
- CVE-2022-28971Tenda AX1806 v1.0.0.1 was discovered to contain a stack over…7.5
- CVE-2022-28972Tenda AX1806 v1.0.0.1 was discovered to contain a stack over…7.5
- CVE-2022-28973Tenda AX1806 v1.0.0.1 was discovered to contain a stack over…7.5
- CVE-2022-28975A stored cross-site scripting (XSS) vulnerability in Infoblo…5.4
- CVE-2022-28978Stored cross-site scripting (XSS) vulnerability in the Site …5.4
- CVE-2022-28979Liferay Portal v7.1.0 through v7.4.2 and Liferay DXP 7.1 bef…6.1
- CVE-2022-2898Measuresoft ScadaPro Server and Client (All Versions) do not…5.5
- CVE-2022-28980Multiple cross-site scripting (XSS) vulnerabilities in Lifer…6.1
- CVE-2022-28981Path traversal vulnerability in the Hypermedia REST APIs mod…7.5
- CVE-2022-28982A cross-site scripting (XSS) vulnerability in Liferay Portal…6.1
Are you affected by CVE-2022-28977?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST