Liferay Vulnerable to Open Redirect via Adaptive Media Administration Page

published 2024-02-20 2 y ago modified 2026-06-17 4 mo ago also GHSA-3mrr-cw9q-727m , EUVD-2023-48664

cvss: 6.1; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.4%; EPSS 0.4% chance of exploitation in 30 days, percentile 32%
public exploits: 0; none known

Open redirect vulnerability in adaptive media administration page in Liferay DXP 2023.Q3 before patch 6, and 7.4 GA through update 92 allows remote attackers to redirect users to arbitrary external URLs via the _com_liferay_adaptive_media_web_portlet_AMPortlet_redirect parameter.

Patch / fix

fixed in 1

maven com.liferay:com.liferay.adaptive.media.web 2023.Q3.6

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 2 y ago (2024-02-20)

Exploit prediction

0.39% chance of exploitation in the next 30 days, higher than 32% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
NVD	3.1	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
GitHub	3.1	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected packages

ecosystem	package	affected	fixed in
maven	com.liferay:com.liferay.adaptive.media.web	>=2023.Q3, <2023.Q3.6 >=7.4.0, <=7.4.13.u92	2023.Q3.6

Affected products

Liferay DXP
liferay digital_experience_platform

Classification

Weakness

CWE-601 URL Redirection to Untrusted Site

References

liferay.dev /portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-44308
vendor-advisory, web
nvd.nist.gov /vuln/detail/CVE-2023-44308
advisory
github.com /liferay/liferay-portal
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary