CVE-2023-35029
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
An open redirect vulnerability exists in the SEO configuration of the Layout module in Liferay Portal versions 7.4.3.70 through 7.4.3.76 and Liferay DXP update 70 through 76. Attackers can exploit the `_com_liferay_layout_admin_web_portlet_GroupPagesPortlet_backURL` parameter to redirect users to arbitrary external URLs.
Risk Assessment
This vulnerability may lead to phishing attacks, where users can be redirected to malicious websites, jeopardizing the organization's data security.
Recommendation
It is recommended to update Liferay Portal and Liferay DXP to the latest versions to mitigate this vulnerability and to monitor the usage of the `_com_liferay_layout_admin_web_portlet_GroupPagesPortlet_backURL` parameter.
Original NVD description (English source)
Open redirect vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.76, and Liferay DXP 7.4 update 70 through 76 allows remote attackers to redirect users to arbitrary external URLs via the `_com_liferay_layout_admin_web_portlet_GroupPagesPortlet_backURL` parameter.