Lucene search
PRIOn knowledge basePRION:CVE-2022-28977HistorySep 22, 2022 - 1:15 a.m.
Design/Logic Flaw
2022-09-2201:15:00
PRIOn knowledge base
www.prio-n.com
3
HtmlUtil.escapeRedirect in Liferay Portal 7.3.1 through 7.4.2, and Liferay DXP 7.0 fix pack 91 through 101, 7.1 fix pack 17 through 25, 7.2 fix pack 5 through 14, and 7.3 before service pack 3 can be circumvented by using multiple forward slashes, which allows remote attackers to redirect users to arbitrary external URLs via the (1) 'redirectparameter (2)FORWARD_URL` parameter, and (3) others parameters that rely on HtmlUtil.escapeRedirect.
| CPE | Name | Operator | Version |
|---|---|---|---|
| dxp | eq | 7.2 fixpack5 | |
| dxp | eq | 7.0 | |
| dxp | eq | 7.1 | |
| dxp | eq | 7.2 | |
| dxp | eq | 7.2 fixpack6 | |
| dxp | eq | 7.2 fixpack7 | |
| dxp | eq | 7.2 fixpack8 | |
| dxp | eq | 7.2 fixpack9 | |
| dxp | eq | 7.1 fixpack17 | |
| dxp | eq | 7.1 fixpack18 |
Related
nvd
nvd
CVE-2022-28977
2022-09-22 01:15:10
CVE-2024-25609
2024-02-20 10:15:08
cve
cve
CVE-2022-28977
2022-09-22 01:15:10
CVE-2024-25609
2024-02-20 10:15:08
cvelist
cvelist
CVE-2022-28977
2022-09-22 00:02:08
CVE-2024-25609
2024-02-20 09:37:55
prion
prion
Design/Logic Flaw
2024-02-20 10:15:00