6.1

CVE-2022-28977

HtmlUtil.escapeRedirect in Liferay Portal 7.3.1 through 7.4.2, and Liferay DXP 7.0 fix pack 91 through 101, 7.1 fix pack 17 through 25, 7.2 fix pack 5 through 14, and 7.3 before service pack 3 can be circumvented by using multiple forward slashes, which allows remote attackers to redirect users to arbitrary external URLs via the (1) 'redirect` parameter (2) `FORWARD_URL` parameter, and (3) others parameters that rely on HtmlUtil.escapeRedirect.

Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Liferay ≫ Digital Experience Platform Version7.0 Update-
Liferay ≫ Digital Experience Platform Version7.0 Updatefix_pack_100
Liferay ≫ Digital Experience Platform Version7.0 Updatefix_pack_101
Liferay ≫ Digital Experience Platform Version7.0 Updatefix_pack_91
Liferay ≫ Digital Experience Platform Version7.0 Updatefix_pack_92
Liferay ≫ Digital Experience Platform Version7.0 Updatefix_pack_93
Liferay ≫ Digital Experience Platform Version7.0 Updatefix_pack_94
Liferay ≫ Digital Experience Platform Version7.0 Updatefix_pack_95
Liferay ≫ Digital Experience Platform Version7.0 Updatefix_pack_96
Liferay ≫ Digital Experience Platform Version7.0 Updatefix_pack_97
Liferay ≫ Digital Experience Platform Version7.0 Updatefix_pack_98
Liferay ≫ Digital Experience Platform Version7.0 Updatefix_pack_99
Liferay ≫ Digital Experience Platform Version7.1 Update-
Liferay ≫ Digital Experience Platform Version7.1 Updatefix_pack_17
Liferay ≫ Digital Experience Platform Version7.1 Updatefix_pack_18
Liferay ≫ Digital Experience Platform Version7.1 Updatefix_pack_19
Liferay ≫ Digital Experience Platform Version7.1 Updatefix_pack_20
Liferay ≫ Digital Experience Platform Version7.1 Updatefix_pack_21
Liferay ≫ Digital Experience Platform Version7.1 Updatefix_pack_22
Liferay ≫ Digital Experience Platform Version7.1 Updatefix_pack_23
Liferay ≫ Digital Experience Platform Version7.1 Updatefix_pack_24
Liferay ≫ Digital Experience Platform Version7.1 Updatefix_pack_25
Liferay ≫ Digital Experience Platform Version7.2 Update-
Liferay ≫ Digital Experience Platform Version7.2 Updatefix_pack_10
Liferay ≫ Digital Experience Platform Version7.2 Updatefix_pack_11
Liferay ≫ Digital Experience Platform Version7.2 Updatefix_pack_12
Liferay ≫ Digital Experience Platform Version7.2 Updatefix_pack_13
Liferay ≫ Digital Experience Platform Version7.2 Updatefix_pack_14
Liferay ≫ Digital Experience Platform Version7.2 Updatefix_pack_5
Liferay ≫ Digital Experience Platform Version7.2 Updatefix_pack_6
Liferay ≫ Digital Experience Platform Version7.2 Updatefix_pack_7
Liferay ≫ Digital Experience Platform Version7.2 Updatefix_pack_8
Liferay ≫ Digital Experience Platform Version7.2 Updatefix_pack_9
Liferay ≫ Dxp Version7.3 Update-
Liferay ≫ Dxp Version7.3 Updatesp1
Liferay ≫ Dxp Version7.3 Updatesp2
Liferay ≫ Liferay Portal Version >= 7.3.1 < 7.4.3.4
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.2% 0.417
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.1 2.8 2.7
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
134c704f-9b21-4f2e-91b3-4a467353bcc0 6.1 2.8 2.7
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE-601 URL Redirection to Untrusted Site ('Open Redirect')

The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.