CVE-2024-25609 json
Liferay Portal and Liferay DXP's HtmlUtil.escapeRedirect Can Be Circumvented via Two Forward Slashes
published 2024-02-20 2 y ago modified 2026-06-17 4 mo ago also GHSA-3qq5-wcrx-4h8r , EUVD-2024-22932
- cvss
- 6.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 29%
- public exploits
- 0
- none known
Summary
HtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.12, and older unsupported versions, and Liferay DXP 7.4 before update 9, 7.3 service pack 3, 7.2 fix pack 15 through 18, and older unsupported versions can be circumvented by using two forward slashes, which allows remote attackers to redirect users to arbitrary external URLs via the (1) 'redirect` parameter (2) `FORWARD_URL` parameter, and (3) others parameters that rely on HtmlUtil.escapeRedirect. This vulnerability is the result of an incomplete fix in CVE-2022-28977.
Patch / fix
- maven com.liferay.portal:release.portal.bom 7.4.3.13-ga13
- maven com.liferay.portal:release.dxp.bom 7.4.13.u9
- liferay digital_experience_platform 7.2
- liferay liferay_portal 7.4.3.13
- github.com/liferay/liferay-portal@3c5ee20 commit
- github.com/liferay/liferay-portal@5c9655c commit
- github.com/liferay/liferay-portal@66f3ae6 commit
- github.com/liferay/liferay-portal@702a1e3 commit
- github.com/liferay/liferay-portal@7aca15e commit
- github.com/liferay/liferay-portal@dca931a commit
- github.com/liferay/liferay-portal@f015ad2 commit
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.36% chance of exploitation in the next 30 days, higher than 29% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| NVD | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| GitHub | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | com.liferay.portal:release.portal.bom | >=7.2.0, <7.4.3.13-ga13 |
7.4.3.13-ga13 |
| maven | com.liferay.portal:release.dxp.bom | >=7.2.10.fp15, <=7.2.10.fp18 >=7.4.0, <7.4.13.u9 |
7.4.13.u9 |
Affected products
- Liferay Portal
- Liferay DXP
Classification
- Weakness
-
- CWE-601 URL Redirection to Untrusted Site
References
-
github.com
/liferay/liferay-portal/commit/3c5ee2054b44e4354cd2e53782914157ef2b5362
web
-
github.com
/liferay/liferay-portal/commit/5c9655c941b18d8948a0c38b2bc84f4a1f83543a
web
-
github.com
/liferay/liferay-portal/commit/66f3ae610c24f10a6950e75e0ca4c981935244ed
web
-
github.com
/liferay/liferay-portal/commit/702a1e35896681f04ec3c7c8075aa87d5e16a18d
web
-
github.com
/liferay/liferay-portal/commit/7aca15e7195a03243d5461fcf09cde0fa7de81f0
web
-
github.com
/liferay/liferay-portal/commit/dca931af71a3d9fbd896a25b92396df8458d2886
web
-
github.com
/liferay/liferay-portal/commit/f015ad20bd9ee1661ccff5fb48e03dd3a1ebf003
web
-
liferay.dev
/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25609
vendor-advisory, web
-
nvd.nist.gov
/vuln/detail/CVE-2024-25609
advisory
-
github.com
/liferay/liferay-portal
package
Sources
- CVE List CVE-2024-25609
- GitHub Advisory GHSA-3qq5-wcrx-4h8r
- NVD CVE-2024-25609
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.