Description

Open redirect vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.76, and Liferay DXP 7.4 update 70 through 76 allows remote attackers to redirect users to arbitrary external URLs via the `_com_liferay_layout_admin_web_portlet_GroupPagesPortlet_backURL` parameter.

Remediation

References

CVE-2023-35029

Related Vulnerabilities

WebLogic Deserialization of Untrusted Data Vulnerability (CVE-2020-10969)

PostgreSQL Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2023-39417)

WordPress Plugin Newsletter-Send awesome emails from WordPress Unspecified Vulnerability (4.1.1)

Oracle Database Server CVE-2015-4796 Vulnerability (CVE-2015-4796)

WordPress Plugin Add Custom Link to WordPress Admin Bar Cross-Site Scripting (1.0)

Severity

Medium

Classification

CVE-2023-35029 CWE-601 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities