CVE-2022-28977 Liferay Portal and Liferay DXP HtmlUtil.escapeRedirect Can Be Circumvented
Remote attackers can redirect users to arbitrary external URLs by bypassing HtmlUtil.escapeRedirect using multiple forward slashes in Liferay Portal.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2022-28977?
CVE-2022-28977 is a medium-severity vulnerability in Liferay Digital Experience Platform, published on 22 Sep 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
HtmlUtil.escapeRedirect in Liferay Portal 7.3.1 through 7.4.2, and Liferay DXP 7.0 fix pack 91 through 101, 7.1 fix pack 17 through 25, 7.2 fix pack 5 through 14, and 7.3 before service pack 3 can be circumvented by using multiple forward slashes, which allows remote attackers to redirect users to arbitrary external URLs via the (1) 'redirect` parameter (2) `FORWARD_URL` parameter, and (3) others parameters that rely on HtmlUtil.escapeRedirect.
Weakness: CWE-601
Which versions are affected by CVE-2022-28977?
10 open source packages ship an affected version, including com.liferay.portal:release.dxp.bom, com.liferay.portal:com.liferay.util.java and com.liferay.portal:release.portal.bom. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
com.liferay.portal:release.dxp.bom Maven | From 7.0.10.fp91 | 7.0.10.fp101 |
com.liferay.portal:release.dxp.bom Maven | From 7.0.10.fp91 | 7.0.10.fp101 |
com.liferay.portal:release.dxp.bom Maven | From 7.1.10.fp17 | 7.1.10.fp25 |
com.liferay.portal:release.dxp.bom Maven | From 7.1.10.fp17 | 7.1.10.fp25 |
com.liferay.portal:release.dxp.bom Maven | From 7.2.10.fp5 | 7.2.10.fp14 |
com.liferay.portal:release.dxp.bom Maven | From 7.2.10.fp5 | 7.2.10.fp14 |
4 more packages
com.liferay.portal:com.liferay.util.java Maven | All versions | 7.9.0 |
com.liferay.portal:com.liferay.util.java Maven | All versions | 7.9.0 |
com.liferay.portal:release.portal.bom Maven | From 7.3.1-ga2 | 7.4.3.4-ga4 |
com.liferay.portal:release.portal.bom Maven | From 7.3.1-ga2 | 7.4.3.4-ga4 |
Products include Liferay Digital Experience Platform, Liferay Dxp, Liferay Liferay Portal.
How do I fix CVE-2022-28977?
Upgrade com.liferay.portal:release.dxp.bom to a fixed version for your release line: 7.0.10.fp101, 7.1.10.fp25 or 7.2.10.fp14.
Is CVE-2022-28977 being exploited?
There is no known exploitation of CVE-2022-28977 in the wild and no public exploit code.
Other vulnerabilities in Liferay Digital Experience Platform
- CVE-2024-8980 Liferay Portal and Liferay DXP Vulnerable to CSRF in the Script Console
- CVE-2023-42496 Liferay Portal and Liferay DXP vulnerable to reflected Cross-site Scripting
- CVE-2023-42498 Liferay Portal Language Override edit screen and Liferay DXP vulnerable to reflected Cross-site Scripting
- CVE-2024-25147 Liferay Portal and Liferay DXP vulnerable to Cross-site Scripting
- CVE-2024-26269 Liferay Portal Frontend JS module's portlet.js and Liferay DXP vulnerable to Cross-site Scripting
Sources
Also known as GHSA-w397-9p2j-6x23.