Description
Open redirect vulnerability in the System Settings in Liferay Portal 7.1.0 through 7.4.3.101, and Liferay DXP 2023.Q3.1 through 2023.Q3.4 , 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to redirect users to arbitrary external URLs via the _com_liferay_configuration_admin_web_portlet_SystemSettingsPortlet_redirect parameter.
Open redirect vulnerability in the Instance Settings in Liferay Portal 7.1.0 through 7.4.3.101, and Liferay DXP 2023.Q3.1 through 2023.Q3.4 , 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to redirect users to arbitrary external URLs via the _com_liferay_configuration_admin_web_portlet_InstanceSettingsPortlet_redirect parameter.
Open redirect vulnerability in the Site Settings in Liferay Portal 7.1.0 through 7.4.3.101, and Liferay DXP 2023.Q3.1 through 2023.Q3.4 , 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to redirect users to arbitrary external URLs via the _com_liferay_site_admin_web_portlet_SiteSettingsPortlet_redirect parameter.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Liferay | Portal | 7.1.0 – ≤ 7.4.3.101 | — |
| Liferay | DXP | 7.3.10 – ≤ 7.3.10-u35, 7.4.13 – ≤ 7.4.13-u92, 2023.Q3.0 – ≤ 2023.Q3.4 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | com.liferay:com.liferay.configuration.admin.web | >= 2.0.7, < 5.0.76 | 5.0.76 | GHSA-m55r-9fx8-725j |
| Maven | com.liferay:com.liferay.site.admin.web | >= 2.0.4, < 5.0.103 | 5.0.103 | GHSA-m55r-9fx8-725j |
Advisories 1
- WID-SEC-2025-2050 Liferay Portal und DXP: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 14, 2025