UpHeron
All vulnerabilities

Servers and applications

CVE-2022-28977

HtmlUtil.escapeRedirect in Liferay Portal 7.3.1 through 7.4.2, and Liferay DXP 7.0 fix pack 91 through 101, 7.1 fix pack 17 through 25, 7.2 fix pack 5 through 14, and 7.3 before service pack 3 can be circumvented by using multiple forward slashes, which allows remote attackers to redirect users to arbitrary external URLs via the (1) 'redirect` parameter (2) `FORWARD_URL` parameter, and (3)…

Severity
Medium 6.1
Published
22 Sept 2022
Last changed
9 Jul 2026
Added to UpHeron
1 Nov 2026
Fixed in
7.4.3.4
Sources
NVD

Affected software

SoftwareAffected versions
Liferay Portal / DXPServers and applications · cpe:a:liferay:digital_experience_platform
  • Version 7.2-fix_pack_14
  • Version 7.2-fix_pack_13
  • Version 7.2-fix_pack_12
  • Version 7.2-fix_pack_11
All 33 release lines
  • Version 7.0
  • Version 7.0-fix_pack_91
  • Version 7.0-fix_pack_92
  • Version 7.0-fix_pack_93
  • Version 7.0-fix_pack_94
  • Version 7.0-fix_pack_95
  • Version 7.0-fix_pack_96
  • Version 7.0-fix_pack_97
  • Version 7.0-fix_pack_98
  • Version 7.0-fix_pack_99
  • Version 7.0-fix_pack_100
  • Version 7.0-fix_pack_101
  • Version 7.1
  • Version 7.1-fix_pack_17
  • Version 7.1-fix_pack_18
  • Version 7.1-fix_pack_19
  • Version 7.1-fix_pack_20
  • Version 7.1-fix_pack_21
  • Version 7.1-fix_pack_22
  • Version 7.1-fix_pack_23
  • Version 7.1-fix_pack_24
  • Version 7.1-fix_pack_25
  • Version 7.2
  • Version 7.2-fix_pack_5
  • Version 7.2-fix_pack_6
  • Version 7.2-fix_pack_7
  • Version 7.2-fix_pack_8
  • Version 7.2-fix_pack_9
  • Version 7.2-fix_pack_10
  • Version 7.2-fix_pack_11
  • Version 7.2-fix_pack_12
  • Version 7.2-fix_pack_13
  • Version 7.2-fix_pack_14
Liferay Portal / DXPServers and applications · cpe:a:liferay:liferay_portal
  • From 7.3.1 before 7.4.3.4

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2022-28977
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2022-28977