CVE-2022-28977
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
The HtmlUtil.escapeRedirect function in Liferay Portal 7.3.1 through 7.4.2 and Liferay DXP 7.0-7.3 can be bypassed using multiple forward slashes, allowing remote attackers to redirect users to arbitrary external URLs via parameters such as 'redirect' or 'FORWARD_URL'.
Risk Assessment
The risk involves potential phishing or social engineering attacks where users may be redirected to malicious sites, leading to credential theft or malware infection.
Recommendation
Immediately upgrade Liferay Portal to version 7.4.3 or later, and for Liferay DXP apply the relevant service packs or security patches as recommended by the vendor.
Original NVD description (English source)
HtmlUtil.escapeRedirect in Liferay Portal 7.3.1 through 7.4.2, and Liferay DXP 7.0 fix pack 91 through 101, 7.1 fix pack 17 through 25, 7.2 fix pack 5 through 14, and 7.3 before service pack 3 can be circumvented by using multiple forward slashes, which allows remote attackers to redirect users to arbitrary external URLs via the (1) 'redirect` parameter (2) `FORWARD_URL` parameter, and (3) others parameters that rely on HtmlUtil.escapeRedirect.