PT-2025-37346 · Liferay · Liferay Dxp+1
Abderrahmane Bounhidja
·
Publicado
2025-09-12
·
Atualizado
2025-12-16
·
CVE-2025-43795
CVSS v3.1
6.1
Média
| Vetor | AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions:
Liferay Portal versions 7.1.0 through 7.4.3.101
Liferay DXP versions 2023.Q3.1 through 2023.Q3.4
Liferay Portal 7.4 GA through update 92
Liferay Portal 7.3 GA through update 35
Older unsupported versions
Description:
An open redirect issue exists in System Settings, Instance Settings, and Site Settings. This allows remote attackers to redirect users to arbitrary external URLs via the
com liferay configuration admin web portlet SystemSettingsPortlet redirect parameter, the com liferay configuration admin web portlet InstanceSettingsPortlet redirect parameter, and the com liferay site admin web portlet SiteSettingsPortlet redirect parameter.Recommendations:
Liferay Portal versions 7.1.0 through 7.4.3.101: Update to a version beyond 7.4.3.101.
Liferay DXP versions 2023.Q3.1 through 2023.Q3.4: Update to a version beyond 2023.Q3.4.
Liferay Portal 7.4 GA through update 92: Update to a version beyond update 92.
Liferay Portal 7.3 GA through update 35: Update to a version beyond update 35.
Older unsupported versions: Update to a supported version.
Correção
Open Redirect
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Liferay Dxp
Liferay Portal