CVE-2023-35029

Published: Jun 15, 2023Modified: Jun 17, 2026

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

Open redirect vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.76, and Liferay DXP 7.4 update 70 through 76 allows remote attackers to redirect users to arbitrary external URLs via the `_com_liferay_layout_admin_web_portlet_GroupPagesPortlet_backURL` parameter.

Affected (8)

Products: Liferay: Dxp, Liferay Portal

Liferay

2 products

Dxp

Liferay Portal

Configuration A

8 vulnerable

Vulnerable Software	Affected Versions
Liferay Dxp	Version 7.4 update_70
Liferay Dxp	Version 7.4 update_71
Liferay Dxp	Version 7.4 update_72
Liferay Dxp	Version 7.4 update_73
Liferay Dxp	Version 7.4 update_74
Liferay Dxp	Version 7.4 update_75
Liferay Dxp	Version 7.4 update_76
Liferay Liferay Portal	From 7.4.3.70 to 7.4.3.77

Related CWEs

CWE-601

URL Redirection to Untrusted Site ('Open Redirect')

A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.

References (2)

https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-35029

Source: security@liferay.com

PatchVendor Advisory

https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-35029

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

Timeline

No history available yet.