{"id":"GHSA-w397-9p2j-6x23","summary":"Liferay Portal and Liferay DXP HtmlUtil.escapeRedirect Can Be Circumvented","details":"HtmlUtil.escapeRedirect in Liferay Portal 7.3.1 through 7.4.2, and Liferay DXP 7.0 fix pack 91 through 101, 7.1 fix pack 17 through 25, 7.2 fix pack 5 through 14, and 7.3 before service pack 3 can be circumvented by using multiple forward slashes, which allows remote attackers to redirect users to arbitrary external URLs via the (1) 'redirect` parameter (2) `FORWARD_URL` parameter, and (3) others parameters that rely on HtmlUtil.escapeRedirect.","aliases":["CVE-2022-28977"],"modified":"2025-07-16T15:27:21.640856Z","published":"2022-09-23T00:00:46Z","database_specific":{"github_reviewed_at":"2025-07-16T14:47:57Z","nvd_published_at":"2022-09-22T01:15:00Z","cwe_ids":["CWE-601"],"severity":"MODERATE","github_reviewed":true},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-28977"},{"type":"WEB","url":"https://github.com/liferay/liferay-portal/commit/242e8bcabe3e8767799d3d1e6c021a75b4ada11b"},{"type":"WEB","url":"https://github.com/liferay/liferay-portal/commit/6389885476414d3cd9e3092b4708906a5bdc8a48"},{"type":"WEB","url":"https://github.com/liferay/liferay-portal/commit/8aa3fd76f34d1a4562bd5b4f82931a0a124e31a8"},{"type":"PACKAGE","url":"https://github.com/liferay/liferay-portal"},{"type":"WEB","url":"https://liferay.atlassian.net/browse/LPE-17327"},{"type":"WEB","url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2022-28977?p_r_p_assetEntryId=121612261&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121612261%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse"},{"type":"WEB","url":"https://web.archive.org/web/20220922060039/https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-28977-htmlutil.escaperedirect-circumvention-with-multiple-forward-slash"},{"type":"WEB","url":"http://liferay.com"}],"affected":[{"package":{"name":"com.liferay.portal:release.portal.bom","ecosystem":"Maven","purl":"pkg:maven/com.liferay.portal/release.portal.bom"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.3.1-ga2"},{"fixed":"7.4.3.4-ga4"}]}],"versions":["7.3.2","7.3.2-1","7.3.3","7.3.3-1","7.3.4","7.3.5","7.3.6","7.3.7","7.4.0","7.4.1","7.4.1-1","7.4.2","7.4.2-1","7.4.3.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/09/GHSA-w397-9p2j-6x23/GHSA-w397-9p2j-6x23.json"}},{"package":{"name":"com.liferay.portal:release.dxp.bom","ecosystem":"Maven","purl":"pkg:maven/com.liferay.portal/release.dxp.bom"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.10.fp91"},{"fixed":"7.0.10.fp101"}]}],"versions":["7.0.10.fp100","7.0.10.fp91","7.0.10.fp92","7.0.10.fp94","7.0.10.fp94-1","7.0.10.fp95","7.0.10.fp95-1","7.0.10.fp95-2","7.0.10.fp97","7.0.10.fp98"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/09/GHSA-w397-9p2j-6x23/GHSA-w397-9p2j-6x23.json"}},{"package":{"name":"com.liferay.portal:release.dxp.bom","ecosystem":"Maven","purl":"pkg:maven/com.liferay.portal/release.dxp.bom"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.1.10.fp17"},{"fixed":"7.1.10.fp25"}]}],"versions":["7.1.10.fp17","7.1.10.fp18","7.1.10.fp19","7.1.10.fp20","7.1.10.fp22","7.1.10.fp24"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/09/GHSA-w397-9p2j-6x23/GHSA-w397-9p2j-6x23.json"}},{"package":{"name":"com.liferay.portal:release.dxp.bom","ecosystem":"Maven","purl":"pkg:maven/com.liferay.portal/release.dxp.bom"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.2.10.fp5"},{"fixed":"7.2.10.fp14"}]}],"versions":["7.2.10.fp10","7.2.10.fp11","7.2.10.fp12","7.2.10.fp13","7.2.10.fp5","7.2.10.fp6","7.2.10.fp7","7.2.10.fp8","7.2.10.fp9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/09/GHSA-w397-9p2j-6x23/GHSA-w397-9p2j-6x23.json"}},{"package":{"name":"com.liferay.portal:com.liferay.util.java","ecosystem":"Maven","purl":"pkg:maven/com.liferay.portal/com.liferay.util.java"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.9.0"}]}],"versions":["1.0.0","2.0.0","2.0.1","2.1.0","2.2.0","2.2.1","2.2.2","2.3.0","2.3.1","2.4.0","2.5.0","2.5.1","2.5.10","2.5.11","2.5.12","2.5.13","2.5.14","2.5.15","2.5.16","2.5.17","2.5.18","2.5.19","2.5.2","2.5.20","2.5.21","2.5.22","2.5.23","2.5.24","2.5.25","2.5.26","2.5.27","2.5.28","2.5.29","2.5.3","2.5.30","2.5.31","2.5.32","2.5.33","2.5.34","2.5.35","2.5.36","2.5.4","2.5.5","2.5.6","2.5.7","2.5.8","2.5.9","2.6.0","2.6.1","2.6.2","2.6.3","2.6.4","3.0.0","3.0.1","3.0.10","3.0.11","3.0.12","3.0.13","3.0.14","3.0.15","3.0.16","3.0.17","3.0.18","3.0.19","3.0.2","3.0.20","3.0.21","3.0.22","3.0.23","3.0.24","3.0.25","3.0.26","3.0.27","3.0.28","3.0.29","3.0.3","3.0.30","3.0.31","3.0.32","3.0.33","3.0.34","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","3.0.9","3.1.0","3.1.1","3.1.2","3.1.3","3.1.4","3.1.5","4.0.0","4.0.1","4.0.10","4.0.11","4.0.12","4.0.13","4.0.14","4.0.15","4.0.16","4.0.17","4.0.18","4.0.19","4.0.2","4.0.20","4.0.21","4.0.22","4.0.23","4.0.24","4.0.25","4.0.26","4.0.3","4.0.4","4.0.5","4.0.6","4.0.7","4.0.8","4.0.9","4.1.0","4.1.1","4.1.2","4.1.3","4.1.4","4.1.5","4.1.6","5.0.0","5.0.1","5.0.10","5.0.11","5.0.2","5.0.3","5.0.4","5.0.5","5.0.6","5.0.7","5.0.8","5.0.9","5.1.0","5.1.1","5.1.2","5.1.3","5.1.4","5.1.5","5.1.6","6.0.0","6.0.1","6.0.2","6.0.3","6.0.4","6.0.5","7.0.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/09/GHSA-w397-9p2j-6x23/GHSA-w397-9p2j-6x23.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}