~ / search / GHSA-548x-j6x6-hcv4

GHSA-548x-j6x6-hcv4

Liferay Portal and Liferay DXP's HtmlUtil.escapeRedirect Can Be Circumvented via Replacement Character

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-25608

Packages

EcosystemPackageAffectedFixed in
Maven com.liferay.portal:release.portal.bom >= 7.2.0, < 7.4.3.19-ga19 7.4.3.19-ga19
Maven com.liferay.portal:release.dxp.bom < 7.2.10.fp19 7.2.10.fp19
Maven com.liferay.portal:release.dxp.bom >= 7.3.0, < 7.3.10.u4 7.3.10.u4
Maven com.liferay.portal:release.dxp.bom >= 7.4.0, < 7.4.13.u19 7.4.13.u19

Details

As written in the advisory (Markdown source, shown as plain text).

HtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.18, and older unsupported versions, and Liferay DXP 7.4 before update 19, 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions can be circumvented by using the 'REPLACEMENT CHARACTER' (U+FFFD), which allows remote attackers to redirect users to arbitrary external URLs via the (1) 'redirect` parameter (2) `FORWARD_URL` parameter, (3) `noSuchEntryRedirect` parameter, and (4) others parameters that rely on HtmlUtil.escapeRedirect.

References

External links from the advisory. They lead to third-party sites.