Liferay Portal and Liferay DXP HtmlUtil.escapeRedirect Can Be Circumvented

🗓️ 23 Sep 2022 00:00:46Reported by GitHub Advisory DatabaseType

Liferay Portal and DXP HtmlUtil.escapeRedirect can be bypassed, allowing remote URL redirects.

Reporter	Title	Published	Views	Family All 15
Circl	CVE-2022-28977	22 Sep 202207:11	–	circl
CNNVD	Liferay Portal和Liferay DXP 输入验证错误漏洞	22 Sep 202200:00	–	cnnvd
CVE	CVE-2022-28977	22 Sep 202200:02	–	cve
Cvelist	CVE-2022-28977	22 Sep 202200:02	–	cvelist
EUVD	EUVD-2022-33408	3 Oct 202520:07	–	euvd
NVD	CVE-2022-28977	22 Sep 202201:15	–	nvd
OSV	CVE-2022-28977	22 Sep 202201:15	–	osv
OSV	GHSA-W397-9P2J-6X23 Liferay Portal and Liferay DXP HtmlUtil.escapeRedirect Can Be Circumvented	23 Sep 202200:00	–	osv
Prion	Design/Logic Flaw	22 Sep 202201:15	–	prion
Prion	Design/Logic Flaw	20 Feb 202410:15	–	prion

Vulners

Node

com.liferay.portal release.dxp.bomRange7.2.10.fp5–7.2.10.fp14maven

com.liferay.portal release.dxp.bomRange7.1.10.fp17–7.1.10.fp25maven

com.liferay.portal release.dxp.bomRange7.0.10.fp91–7.0.10.fp101maven

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2022-28977
liferay	www.liferay.com/
github	www.github.com/liferay/liferay-portal/commit/242e8bcabe3e8767799d3d1e6c021a75b4ada11b
github	www.github.com/liferay/liferay-portal/commit/6389885476414d3cd9e3092b4708906a5bdc8a48
github	www.github.com/liferay/liferay-portal/commit/8aa3fd76f34d1a4562bd5b4f82931a0a124e31a8
liferay	www.liferay.atlassian.net/browse/LPE-17327
liferay	www.liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2022-28977
web	www.web.archive.org/web/20220922060039/https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-28977-htmlutil.escaperedirect-circumvention-with-multiple-forward-slash
github	www.github.com/advisories/GHSA-w397-9p2j-6x23

16 Jul 2025 14:47Current

6.1Medium risk

Vulners AI Score6.1

CVSS 3.16.1

EPSS0.0051

SSVC