CVE-2023-5190
Last modified
CVE-2023-5190 is a medium-severity vulnerability rated 6.1/10 on the CVSS scale. Open redirect vulnerability in the Countries Management’s edit region page in Liferay Portal 7.4.3.45 through 7.4.3.101, and Liferay DXP 2023.Q3 before patch 6, and 7.4 update 45 through 92 allows remote attackers to redirect users to arbitrary external URLs via the _com_liferay_address_web_internal_portlet_CountriesManagementAdminPortlet_redirect parameter.. EPSS estimates a 0.39% chance of exploitation in the next 30 days.
Description
Open redirect vulnerability in the Countries Management’s edit region page in Liferay Portal 7.4.3.45 through 7.4.3.101, and Liferay DXP 2023.Q3 before patch 6, and 7.4 update 45 through 92 allows remote attackers to redirect users to arbitrary external URLs via the _com_liferay_address_web_internal_portlet_CountriesManagementAdminPortlet_redirect parameter.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Liferay | Digital Experience Platform | 7.4 | Update45 |
| Liferay | Digital Experience Platform | 2023.q3.0 | — |
| Liferay | Digital Experience Platform | 2023.q3.1 | — |
| Liferay | Digital Experience Platform | 2023.q3.2 | — |
| Liferay | Digital Experience Platform | 2023.q3.3 | — |
| Liferay | Digital Experience Platform | 2023.q3.4 | — |
| Liferay | Digital Experience Platform | 2023.q3.5 | — |
| Liferay | Liferay Portal | >= 7.4.3.45, < 7.4.3.102 | — |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2023-5190?
How severe is CVE-2023-5190?
How do I fix CVE-2023-5190?
How Strix Helps
- One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-51887Command Injection vulnerability in Mathtex v.1.05 and before…9.8
- CVE-2023-51888Buffer Overflow vulnerability in the nomath() function in Ma…7.5
- CVE-2023-51889Stack Overflow vulnerability in the validate() function in M…9.8
- CVE-2023-5189A path traversal vulnerability exists in Ansible when extrac…6.5
- CVE-2023-51890An infinite loop issue discovered in Mathtex 1.05 and before…7.5
- CVE-2023-51892An issue in weaver e-cology v.10.0.2310.01 allows a remote a…9.8
- CVE-2023-51906An issue in yonyou YonBIP v3_23.05 allows a remote attacker …9.8
- CVE-2023-5192Excessive Data Query Operations in a Large Data Table in Git…6.5
- CVE-2023-51924An arbitrary file upload vulnerability in the uap.framework.…9.8
- CVE-2023-51925An arbitrary file upload vulnerability in the nccloud.web.ar…9.8
- CVE-2023-51926YonBIP v3_23.05 was discovered to contain an arbitrary file …7.5
- CVE-2023-51927YonBIP v3_23.05 was discovered to contain a SQL injection vu…9.8
Are you affected by CVE-2023-5190?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST