{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/47064?format=json","vulnerability_id":"VCID-9yw4-52sc-rbbz","summary":"Liferay Portal and Liferay DXP's HtmlUtil.escapeRedirect Can Be Circumvented via Two Forward Slashes\nHtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.12, and older unsupported versions, and Liferay DXP 7.4 before update 9, 7.3 service pack 3, 7.2 fix pack 15 through 18, and older unsupported versions can be circumvented by using two forward slashes, which allows remote attackers to redirect users to arbitrary external URLs via the (1) 'redirect` parameter (2) `FORWARD_URL` parameter, and (3) others parameters that rely on HtmlUtil.escapeRedirect. This vulnerability is the result of an incomplete fix in CVE-2022-28977.","aliases":[{"alias":"CVE-2024-25609"},{"alias":"GHSA-3qq5-wcrx-4h8r"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/69035?format=json","purl":"pkg:maven/com.liferay.portal/release.dxp.bom@7.4.13.u9","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.4.13.u9"},{"url":"http://public2.vulnerablecode.io/api/packages/69055?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.13-ga13","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.13-ga13"}],"affected_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/68843?format=json","purl":"pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp15","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-9yw4-52sc-rbbz"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp15"},{"url":"http://public2.vulnerablecode.io/api/packages/68836?format=json","purl":"pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp18","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-9yw4-52sc-rbbz"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp18"},{"url":"http://public2.vulnerablecode.io/api/packages/67365?format=json","purl":"pkg:maven/com.liferay.portal/release.dxp.bom@7.4.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1fqz-psdf-g7dm"},{"vulnerability":"VCID-42k1-vb9z-3qe7"},{"vulnerability":"VCID-9hvg-h2ra-nbcc"},{"vulnerability":"VCID-9yw4-52sc-rbbz"},{"vulnerability":"VCID-a7z8-2fzy-2qee"},{"vulnerability":"VCID-c3ym-wtv5-hfhr"},{"vulnerability":"VCID-e5c7-wsvb-dyfm"},{"vulnerability":"VCID-ggs5-4zac-vqa7"},{"vulnerability":"VCID-gkn8-ehfa-3ugx"},{"vulnerability":"VCID-k9yt-aj7x-3bht"},{"vulnerability":"VCID-tqvb-a46r-jbf8"},{"vulnerability":"VCID-xe2v-j69t-d3h3"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.4.0"},{"url":"http://public2.vulnerablecode.io/api/packages/68799?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.2.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1fqz-psdf-g7dm"},{"vulnerability":"VCID-266t-4gfq-duh4"},{"vulnerability":"VCID-77qw-vmwe-x3d4"},{"vulnerability":"VCID-8jv6-163j-a7b2"},{"vulnerability":"VCID-9471-umbz-pucy"},{"vulnerability":"VCID-9yw4-52sc-rbbz"},{"vulnerability":"VCID-e5c7-wsvb-dyfm"},{"vulnerability":"VCID-ebzh-bpks-5qe2"},{"vulnerability":"VCID-ggs5-4zac-vqa7"},{"vulnerability":"VCID-hw1d-gdcv-vkec"},{"vulnerability":"VCID-k9yt-aj7x-3bht"},{"vulnerability":"VCID-mcea-q7za-duay"},{"vulnerability":"VCID-p9am-1rhf-6bh2"},{"vulnerability":"VCID-qks2-mqk8-wffq"},{"vulnerability":"VCID-ub82-jbgf-mfb8"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.2.0"}],"references":[{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/3c5ee2054b44e4354cd2e53782914157ef2b5362","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/3c5ee2054b44e4354cd2e53782914157ef2b5362"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/5c9655c941b18d8948a0c38b2bc84f4a1f83543a","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/5c9655c941b18d8948a0c38b2bc84f4a1f83543a"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/66f3ae610c24f10a6950e75e0ca4c981935244ed","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/66f3ae610c24f10a6950e75e0ca4c981935244ed"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/702a1e35896681f04ec3c7c8075aa87d5e16a18d","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/702a1e35896681f04ec3c7c8075aa87d5e16a18d"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/7aca15e7195a03243d5461fcf09cde0fa7de81f0","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/7aca15e7195a03243d5461fcf09cde0fa7de81f0"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/dca931af71a3d9fbd896a25b92396df8458d2886","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/dca931af71a3d9fbd896a25b92396df8458d2886"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/f015ad20bd9ee1661ccff5fb48e03dd3a1ebf003","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/f015ad20bd9ee1661ccff5fb48e03dd3a1ebf003"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25609","reference_id":"CVE-2024-25609","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25609"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2024-25609","reference_id":"CVE-2024-25609","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-25609"},{"reference_url":"https://github.com/advisories/GHSA-3qq5-wcrx-4h8r","reference_id":"GHSA-3qq5-wcrx-4h8r","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-3qq5-wcrx-4h8r"}],"weaknesses":[{"cwe_id":601,"name":"URL Redirection to Untrusted Site ('Open Redirect')","description":"A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks."},{"cwe_id":937,"name":"OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities","description":"Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013."},{"cwe_id":1035,"name":"OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities","description":"Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017."}],"exploits":[],"severity_range_score":"4.0 - 6.9","exploitability":"0.5","weighted_severity":"6.2","risk_score":3.1,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-9yw4-52sc-rbbz"}