Sign in
Deutsch English Español Polski
Medium

Liferay Portal and Liferay DXP's HtmlUtil.escapeRedirect Can Be Circumvented via Two Forward Slashes

  • Disclosed: 20.02.2024
  • Updated: 11.10.2026 12:22

HtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.12, and older unsupported versions, and Liferay DXP 7.4 before update 9, 7.3 service pack 3, 7.2 fix pack 15 through 18, and older unsupported versions can be circumvented by using two forward slashes, which allows remote attackers to redirect users to arbitrary external URLs via the (1) 'redirectparameter (2)FORWARD_URL` parameter, and (3) others parameters that rely on HtmlUtil.escapeRedirect. This vulnerability is the result of an incomplete fix in CVE-2022-28977.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Java / Kotlin (Maven) com.liferay.portal:release.dxp.bom >= 7.2.10.fp15, <= 7.2.10.fp18, >= 7.4.0, < 7.4.13.u9 7.4.13.u9
Java / Kotlin (Maven) com.liferay.portal:release.portal.bom >= 7.2.0, < 7.4.3.13-ga13 7.4.3.13-ga13

References

CVSS score 6.1/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness (CWE)
CWE-601
Platform
Java / Kotlin (Maven)
Package
com.liferay.portal:release.dxp.bom, com.liferay.portal:release.portal.bom
Disclosed
20.02.2024
Updated
11.10.2026 12:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-3qq5-wcrx-4h8r - CC BY 4.0

Vulnerability history: com.liferay.portal:release.dxp.bom

All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (125) in the archive
Total entries
125
First → latest
02.2022 09.2025
Without a fix
8
Exploited in attacks
0

Severity breakdown

  • Critical 24
  • High 19
  • Medium 82

Disclosures per year

Severity:
  1. Liferay Portal and Liferay DXP Workflow Component Does Not Check User Permissions
    Critical · 9.0 CVE-2024-38002 >= 2023.Q4.0, < 2023.Q4.6, >= 2023.Q3.1, < 2023.Q3.9, >= 7.3-ga, < 7.3.10.u36, >= 7.4-ga, < 7.4.13.u92 2023.Q4.6, 2023.Q3.9, 7.3.10.u36, 7.4.13.u92
  2. Liferay Portal and Liferay DXP Vulnerable to CSRF in the Script Console
    Critical · 9.6 CVE-2024-8980 >= 2023.Q3.1, < 2023.Q3.5, >= 7.0.0-GA, <= 7.0.10.fp102, >= 7.1.0-GA, <= 7.1.10.fp28, >= 7.2.0.GA, <= 7.2.10.fp20, >= 7.3.0-GA, < 7.3.10.u36, >= 7.4.0-GA, <= 7.4.13.u92 2023.Q3.5, 7.3.10.u36
  3. Liferay Portal and Liferay DXP Vulnerable to Cross-Site Request Forgery (CSRF) via the My Account Widget
    High · 8.8 CVE-2024-26271 >= 2023.Q4.0, < 2023.Q4.3, >= 2023.Q3.1, < 2023.Q3.6, >= 7.3u32, < 7.3u37, >= 7.4u75, < 7.4u93 2023.Q4.3, 2023.Q3.6, 7.3u37, 7.4u93
  4. Liferay Portal and Liferay DXP Vulnerable to Cross-Site Request Forgery (CSRF) via the Content Page Editor
    High · 8.8 CVE-2024-26273 >= 2023.Q4.0, < 2023.Q4.3, >= 2023.Q3.1, < 2023.Q3.6, >= 7.4.GA, < 7.4u93, >= 7.3u29, < 7.3u36 2023.Q4.3, 2023.Q3.6, 7.4u93, 7.3u36
  5. Liferay Portal and Liferay DXP Vulnerable to Cross-Site Request Forgery (CSRF) via the Content Page Editor
    High · 8.8 CVE-2024-26272 >= 2023.Q4.0, < 2023.Q4.3, >= 2023.Q3.1, < 2023.Q3.6, >= 7.3.GA, < 7.3u36, >= 7.4.GA, < 7.4u93 2023.Q4.3, 2023.Q3.6, 7.3u36, 7.4u93
  6. Liferay Portal Document and Media widget and Liferay DXP vulnerable to stored Cross-site Scripting
    Critical · 9.0 CVE-2023-47795 >= 2023.Q3, < 2023.Q3.6, >= 7.4.13.u18, <= 7.4.13.u92 2023.Q3.6
  7. Liferay Portal's Dynamic Data Mapping module's DDMForm and Liferay DXP vulnerable to stored Cross-site Scripting
    Critical · 9.0 CVE-2024-25603 >= 7.4.13.u1, <= 7.4.13.u102, >= 7.3.10.ep3, < 7.3.10.u4, >= 7.2.0, < 7.2.10.fp17 7.3.10.u4, 7.2.10.fp17
  8. Liferay Portal Frontend JS module's portlet.js and Liferay DXP vulnerable to Cross-site Scripting
    Critical · 9.6 CVE-2024-26269 >= 7.4.13.u1, < 7.4.13.u38, >= 7.3.10.ep3, < 7.3.10.u11, >= 7.2.0, < 7.2.10.fp20 7.4.13.u38, 7.3.10.u11, 7.2.10.fp20
  9. Liferay Portal and Liferay DXP vulnerable to stored Cross-site Scripting
    Critical · 9.0 CVE-2024-26266 >= 7.4.13.u1, < 7.4.13.u10, >= 7.3.10.ep3, < 7.3.10.u4, >= 7.2.0, < 7.2.10.fp17 7.4.13.u10, 7.3.10.u4, 7.2.10.fp17
  10. Liferay Portal and Liferay DXP vulnerable to reflected Cross-site Scripting
    Critical · 9.0 CVE-2023-40191 >= 2023.Q3, < 2023.Q3.6, >= 7.4.13.u44, <= 7.4.13.u92 2023.Q3.6
  11. Liferay Portal Language Override edit screen and Liferay DXP vulnerable to reflected Cross-site Scripting
    Critical · 9.6 CVE-2023-42498 >= 2023.Q3, < 2023.Q3.5, >= 7.4.13.u4, <= 7.4.13.u92 2023.Q3.5
  12. Liferay Portal and Liferay DXP vulnerable to reflected Cross-site Scripting
    Critical · 9.6 CVE-2023-42496 >= 7.4.10.ep1, <= 7.4.13.u92, >= 7.3.10.ep3, < 7.3.10.u34, >= 2023.Q3, < 2023.Q3.6 7.3.10.u34, 2023.Q3.6
  13. Liferay Portal Expando module and Liferay DXP vulnerable to stored Cross-site Scripting
    Critical · 9.0 CVE-2024-25601 >= 7.3.0, < 7.3.10.u4, >= 7.2.0, < 7.2.10.fp17 7.3.10.u4, 7.2.10.fp17
  14. Liferay Portal and Liferay DXP's Users Admin module vulnerable to stored Cross-site Scripting
    Critical · 9.0 CVE-2024-25602 >= 7.3.0, < 7.3.10.u4, >= 7.2.0, < 7.2.10.fp17 7.3.10.u4, 7.2.10.fp17
  15. Liferay Portal Message Board widget and Liferay DXP vulnerable to stored Cross-site Scripting
    Critical · 9.0 CVE-2024-25152 >= 7.3.0, < 7.3.10.u4, >= 7.2.0, < 7.2.10.fp17 7.3.10.u4, 7.2.10.fp17
  16. Liferay Portal and Liferay DXP vulnerable to Cross-site Scripting
    Critical · 9.6 CVE-2024-25147 >= 7.3.0, < 7.3.10.u4, >= 7.2.0, < 7.2.10.fp15 7.3.10.u4, 7.2.10.fp15
  17. Liferay Portal and Liferay DXP Vulnerable to Cross-Site Request Forgery in Terms of Use Page
    High · 8.8 CVE-2021-29050 >= 7.2.0, < 7.2.10.fp11 7.2.10.fp11
  18. Liferay Portal has a Stored XSS with Blog entries (Insecure defaults)
    Critical · 9.0 CVE-2024-25610 >= 7.4.0, < 7.4.13.u9, >= 7.3.0, < 7.3.10.u4, < 7.2.10.fp19 7.4.13.u9, 7.3.10.u4, 7.2.10.fp19
  19. Liferay Portal defaults to a low work factor for the default password hashing algorithm
    High · 8.1 CVE-2024-25607 >= 7.3.0, < 7.3.10.u4, < 7.2.10.fp17, >= 7.4.0, < 7.4.13.u16 7.3.10.u4, 7.2.10.fp17, 7.4.13.u16
  20. Liferay Portal and Liferay DXP's HtmlUtil.escapeRedirect Can Be Circumvented via Two Forward Slashes this entry
    Medium · 6.1 CVE-2024-25609 >= 7.2.10.fp15, <= 7.2.10.fp18, >= 7.4.0, < 7.4.13.u9 7.4.13.u9
  21. Liferay Portal has an XXE vulnerability in Java2WsddTask._format
    High · 8.0 CVE-2024-25606 >= 7.3.0, < 7.3.10.u12, >= 7.4.0, < 7.4.13.u4, < 7.2.10.fp20 7.3.10.u12, 7.4.13.u4, 7.2.10.fp20
  22. Liferay Portal vulnerable to user impersonation
    High · 8.1 CVE-2024-25148 >= 7.2.0, < 7.2.10.fp15, >= 7.3.0, < 7.3.10.u4 7.2.10.fp15, 7.3.10.u4
  23. Liferay Portal stored cross-site scripting (XSS) vulnerability
    Critical · 9.6 CVE-2024-25145 >= 7.4.0, < 7.4.3.13u8, >= 7.3.0, < 7.3.10.u4, < 7.2.10.fp17 7.4.3.13u8, 7.3.10.u4, 7.2.10.fp17
  24. Liferay Portal and Liferay DXP Vulnerable to XSS in the Commerce Module
    Critical · 9.6 CVE-2023-42627 >= 7.3.0, <= 7.3.10.u33, >= 7.4.0, <= 7.4.13.u92 no fix
  25. Liferay Portal and Liferay DXP Vulnerable to XSS in the Wiki Widget
    Critical · 9.0 CVE-2023-42628 >= 7.0.10.fp83, <= 7.0.10.fp102, >= 7.1.0, <= 7.1.10.fp28, >= 7.2.0, <= 7.2.10.fp20, >= 7.3.0, < 7.3.10.u34, >= 7.4.0, < 7.4.13.u88 7.3.10.u34, 7.4.13.u88
  26. Liferay Portal and Liferay DXP Vulnerable to XSS via the OAuth2ProviderApplicationRedirect Class
    Critical · 9.6 CVE-2023-44311 >= 7.4.13.u41, < 7.4.13.u90 7.4.13.u90
  27. Liferay Portal and Liferay DXP Vulnerable to XSS via the Page Tree Menu
    Critical · 9.0 CVE-2023-44310 >= 7.3.10.fp1, <= 7.3.10.fp23, >= 7.4.0, < 7.4.13.u79 7.4.13.u79
  28. Liferay Portal and Liferay DXP Vulnerable to XSS in the Fragment Components
    Critical · 9.0 CVE-2023-44309 >= 7.4.0, < 7.4.13.u54 7.4.13.u54
  29. Liferay Portal and Liferay DXP Vulnerable to Stored XSS in the Manage Vocabulary Page
    Critical · 9.0 CVE-2023-42629 >= 7.4.0, < 7.4.13.u88 7.4.13.u88
  30. Liferay Portal and Liferay DXP Vulnerable to Reflected XSS via the Export for Translation Page
    Critical · 9.6 CVE-2023-42497 >= 7.4.0, < 7.4.13.u86 7.4.13.u86
  31. Liferay Portal and Liferay DXP Vulnerable to CSRF via the Layout Module
    High · 8.8 CVE-2023-35030 >= 7.4.13.u70, <= 7.4.13.u76 no fix
  32. Liferay Portal and Liferay DXP Vulnerable to SQL Injection via Friendly URL Module
    Critical · 9.8 CVE-2022-42122 >= 7.3.10.fp2, < 7.3.10.u4 7.3.10.u4
  33. Liferay Portal and Liferay DXP Vulnerable to SQL Injection via the Fragment Module
    Critical · 9.8 CVE-2022-42120 >= 7.3.0, < 7.3.10.u4, >= 7.4.0, < 7.4.13.u17 7.3.10.u4, 7.4.13.u17
  34. Liferay Portal and Liferay DXP Vulnerable to SQL Injection via the Layout Module
    High · 8.8 CVE-2022-42121 >= 7.1.0, < 7.1.10.fp27, >= 7.2.0, < 7.2.10.fp17 7.1.10.fp27, 7.2.10.fp17
  35. Liferay Portal and Liferay DXP fails to invalidate password reset tokens after use
    High · 7.5 CVE-2021-33322 >= 7.0.0, < 7.0.10.fp96, >= 7.1.0, < 7.1.10.fp18, >= 7.2.0, < 7.2.10.fp5 7.0.10.fp96, 7.1.10.fp18, 7.2.10.fp5
  36. Liferay Portal and Liferay DXP Has Company Administrator Accounts Vulnerable to Takeovers
    High · 7.2 CVE-2021-33335 >= 7.1.0, < 7.1.10.fp20, >= 7.2.0, < 7.2.10.fp9 7.1.10.fp20, 7.2.10.fp9
  37. Liferay Portal Layout Module and Liferay DXP Exposes the Cross-Site Request Forgery (CSRF) Token in URLs
    High · 7.5 CVE-2021-33338 >= 7.1.0, < 7.1.10.fp19, >= 7.2.0, < 7.2.10.fp6 7.1.10.fp19, 7.2.10.fp6
  38. Liferay Portal and Liferay DXP autosaves form data for other users to see
    High · 7.5 CVE-2021-33323 >= 7.1.0, < 7.1.10.fp19, >= 7.2.0, < 7.2.10.fp7 7.1.10.fp19, 7.2.10.fp7
  39. Liferay Portal and Liferay DXP Vulnerable to Multiple SQL Injections
    High · 8.8 CVE-2021-29053 < 7.3.10.fp1 7.3.10.fp1
  40. Liferay Portal and Liferay DXP Fails to Invalidate CAPTCHA Answers After Use
    High · 7.5 CVE-2021-29047 < 7.3.10.fp1 7.3.10.fp1
  41. Liferay Portal and Liferay DXP have Insecure Deserialization Vulnerability
    High · 8.1 CVE-2020-15842 >= 7.0.0, < 7.0.10.fp90, >= 7.1.0, < 7.1.10.fp17, >= 7.2.0, < 7.2.10.fp5 7.0.10.fp90, 7.1.10.fp17, 7.2.10.fp5
  42. Liferay Portal and Liferay DXP Potentially Reveal LDAP Server Password via Unsafe Connection
    High · 8.3 CVE-2020-15841 >= 7.0.0, < 7.0.10.fp89, >= 7.1.0, < 7.1.10.fp17, >= 7.2.0, < 7.2.10.fp4 7.0.10.fp89, 7.1.10.fp17, 7.2.10.fp4
  43. Liferay Portal and Liferay DXP Vulnerable to Arbitrary Code Execution
    High · 8.8 CVE-2020-13445 >= 7.0.0, < 7.0.10.fp92, >= 7.1.0, < 7.1.10.fp18, >= 7.2.0, < 7.2.10.fp6 7.0.10.fp92, 7.1.10.fp18, 7.2.10.fp6
  44. Liferay Portal and Liferay DXP fails to properly import users from LDAP
    High · 7.5 CVE-2021-38266 < 7.3.0-ga1 7.3.0-ga1

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.