Moderate severityNVD Advisory· Published Feb 20, 2024· Updated Aug 23, 2024
CVE-2024-25609
CVE-2024-25609
Description
HtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.12, and older unsupported versions, and Liferay DXP 7.4 before update 9, 7.3 service pack 3, 7.2 fix pack 15 through 18, and older unsupported versions can be circumvented by using two forward slashes, which allows remote attackers to redirect users to arbitrary external URLs via the (1) 'redirect parameter (2) FORWARD_URL` parameter, and (3) others parameters that rely on HtmlUtil.escapeRedirect. This vulnerability is the result of an incomplete fix in CVE-2022-28977.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
com.liferay.portal:release.portal.bomMaven | >= 7.2.0, < 7.4.3.13-ga13 | 7.4.3.13-ga13 |
com.liferay.portal:release.dxp.bomMaven | >= 7.2.10.fp15, <= 7.2.10.fp18 | — |
com.liferay.portal:release.dxp.bomMaven | >= 7.4.0, < 7.4.13.u9 | 7.4.13.u9 |
Affected products
4- ghsa-coords2 versions
>= 7.2.10.fp15, <= 7.2.10.fp18+ 1 more
- (no CPE)range: >= 7.2.10.fp15, <= 7.2.10.fp18
- (no CPE)range: >= 7.2.0, < 7.4.3.13-ga13
Patches
Vulnerability mechanics
References
10- github.com/advisories/GHSA-3qq5-wcrx-4h8rghsaADVISORY
- liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25609ghsavendor-advisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2024-25609ghsaADVISORY
- github.com/liferay/liferay-portal/commit/3c5ee2054b44e4354cd2e53782914157ef2b5362ghsaWEB
- github.com/liferay/liferay-portal/commit/5c9655c941b18d8948a0c38b2bc84f4a1f83543aghsaWEB
- github.com/liferay/liferay-portal/commit/66f3ae610c24f10a6950e75e0ca4c981935244edghsaWEB
- github.com/liferay/liferay-portal/commit/702a1e35896681f04ec3c7c8075aa87d5e16a18dghsaWEB
- github.com/liferay/liferay-portal/commit/7aca15e7195a03243d5461fcf09cde0fa7de81f0ghsaWEB
- github.com/liferay/liferay-portal/commit/dca931af71a3d9fbd896a25b92396df8458d2886ghsaWEB
- github.com/liferay/liferay-portal/commit/f015ad20bd9ee1661ccff5fb48e03dd3a1ebf003ghsaWEB
News mentions
0No linked articles in our index yet.