GitHub Advisoryadvisory · Maven

GHSA-22w7-m5f8-87vh Liferay Portal and Liferay DXP Vulnerable to Open Redirect via the Layout Module

MEDIUM Published 2023-06-15 Modified 2025-08-08 Official page ↗
Aliases
CVE-2023-35029
Ecosystem
Maven
Packages
com.liferay.portal:release.portal.bom, com.liferay.portal:release.dxp.bom
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-601
Reviewed
2025-08-08

Affected packages

• Maven com.liferay.portal:release.portal.bom: >= 7.4.3.70-ga70, < 7.4.3.77-ga77 → fixed in 7.4.3.77-ga77 • Maven com.liferay.portal:release.dxp.bom: >= 7.4.13.u70, <= 7.4.13.u76 (no fix yet)

Description

Open redirect vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.76, and Liferay DXP 7.4 update 70 through 76 allows remote attackers to redirect users to arbitrary external URLs via the `_com_liferay_layout_admin_web_portlet_GroupPagesPortlet_backURL` parameter.

Related

Alias · CVE (1)

  • CVE-2023-35029 Open redirect vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.76, and Liferay DXP 7.4… vulnerability

Weakness · CWE (1)

  • CWE-601 URL Redirection to Untrusted Site weakness

References