CVE-2022-28977
Liferay Portal and Liferay DXP HtmlUtil.escapeRedirect Can Be Circumvented
HtmlUtil.escapeRedirect in Liferay Portal 7.3.1 through 7.4.2, and Liferay DXP 7.0 fix pack 91 through 101, 7.1 fix pack 17 through 25, 7.2 fix pack 5 through 14, and 7.3 before service pack 3 can be circumvented by using multiple forward slashes, which allows remote attackers to redirect users to arbitrary external URLs via the (1) 'redirectparameter (2)FORWARD_URL` parameter, and (3) others parameters that rely on HtmlUtil.escapeRedirect.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
HtmlUtil.escapeRedirect in Liferay Portal 7.3.1 through 7.4.2, and Liferay DXP 7.0 fix pack 91 through 101, 7.1 fix pack 17 through 25, 7.2 fix pack 5 through 14, and 7.3 before service pack 3 can be circumvented by using multiple forward slashes, which allows remote attackers to redirect users to arbitrary external URLs via the (1) 'redirectparameter (2)FORWARD_URL` parameter, and (3) others parameters that rely on HtmlUtil.escapeRedirect.
- Record
CVE-2022-28977- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
CVE List
HtmlUtil.escapeRedirect in Liferay Portal 7.3.1 through 7.4.2, and Liferay DXP 7.0 fix pack 91 through 101, 7.1 fix pack 17 through 25, 7.2 fix pack 5 through 14, and 7.3 before service pack 3 can be circumvented by using multiple forward slashes, which allows remote attackers to redirect users to arbitrary external URLs via the (1) 'redirectparameter (2)FORWARD_URL` parameter, and (3) others parameters that rely on HtmlUtil.escapeRedirect.
- Record
CVE-2022-28977- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
EUVDEUVD-2022-33408
HtmlUtil.escapeRedirect in Liferay Portal 7.3.1 through 7.4.2, and Liferay DXP 7.0 fix pack 91 through 101, 7.1 fix pack 17 through 25, 7.2 fix pack 5 through 14, and 7.3 before service pack 3 can be circumvented by using multiple forward slashes, which allows remote attackers to redirect users to arbitrary external URLs via the (1) 'redirectparameter (2)FORWARD_URL` parameter, and (3) others parameters that rely on HtmlUtil.escapeRedirect.
- Record
EUVD-2022-33408- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-w397-9p2j-6x23
Liferay Portal and Liferay DXP HtmlUtil.escapeRedirect Can Be Circumvented
HtmlUtil.escapeRedirect in Liferay Portal 7.3.1 through 7.4.2, and Liferay DXP 7.0 fix pack 91 through 101, 7.1 fix pack 17 through 25, 7.2 fix pack 5 through 14, and 7.3 before service pack 3 can be circumvented by using multiple forward slashes, which allows remote attackers to redirect users to arbitrary external URLs via the (1) 'redirectparameter (2)FORWARD_URL` parameter, and (3) others parameters that rely on HtmlUtil.escapeRedirect.
- Record
GHSA-w397-9p2j-6x23- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
OSV
HtmlUtil.escapeRedirect in Liferay Portal 7.3.1 through 7.4.2, and Liferay DXP 7.0 fix pack 91 through 101, 7.1 fix pack 17 through 25, 7.2 fix pack 5 through 14, and 7.3 before service pack 3 can be circumvented by using multiple forward slashes, which allows remote attackers to redirect users to arbitrary external URLs via the (1) 'redirectparameter (2)FORWARD_URL` parameter, and (3) others parameters that rely on HtmlUtil.escapeRedirect.
- Record
CVE-2022-28977- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-w397-9p2j-6x23
Liferay Portal and Liferay DXP HtmlUtil.escapeRedirect Can Be Circumvented
HtmlUtil.escapeRedirect in Liferay Portal 7.3.1 through 7.4.2, and Liferay DXP 7.0 fix pack 91 through 101, 7.1 fix pack 17 through 25, 7.2 fix pack 5 through 14, and 7.3 before service pack 3 can be circumvented by using multiple forward slashes, which allows remote attackers to redirect users to arbitrary external URLs via the (1) 'redirectparameter (2)FORWARD_URL` parameter, and (3) others parameters that rely on HtmlUtil.escapeRedirect.
- Record
GHSA-w397-9p2j-6x23- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
com.liferay.portal:release.portal.bomMaven |
7.3.1-ga2 up to 7.4.3.4-ga4 | 7.4.3.4-ga4 |
com.liferay.portal:release.dxp.bomMaven |
7.0.10.fp91 up to 7.0.10.fp101 | 7.0.10.fp101 |
com.liferay.portal:release.dxp.bomMaven |
7.1.10.fp17 up to 7.1.10.fp25 | 7.1.10.fp25 |
com.liferay.portal:release.dxp.bomMaven |
7.2.10.fp5 up to 7.2.10.fp14 | 7.2.10.fp14 |
com.liferay.portal:com.liferay.util.javaMaven |
before 7.9.0 | 7.9.0 |
com.liferay.portal:release.portal.bomMaven |
7.3.1-ga2 up to 7.4.3.4-ga4, plus listed versions 7.3.27.3.2-17.3.37.3.3-17.3.4 Show 9 moreShow less7.3.57.3.67.3.77.4.07.4.17.4.1-17.4.27.4.2-17.4.3.4 |
7.4.3.4-ga4 |
com.liferay.portal:release.dxp.bomMaven |
7.0.10.fp91 up to 7.0.10.fp101, plus listed versions 7.0.10.fp1007.0.10.fp927.0.10.fp947.0.10.fp94-17.0.10.fp95 Show 4 moreShow less7.0.10.fp95-17.0.10.fp95-27.0.10.fp977.0.10.fp98 |
7.0.10.fp101 |
com.liferay.portal:release.dxp.bomMaven |
7.1.10.fp17 up to 7.1.10.fp25, plus listed versions 7.1.10.fp187.1.10.fp197.1.10.fp207.1.10.fp227.1.10.fp24 |
7.1.10.fp25 |
com.liferay.portal:release.dxp.bomMaven |
7.2.10.fp5 up to 7.2.10.fp14, plus listed versions 7.2.10.fp107.2.10.fp117.2.10.fp127.2.10.fp137.2.10.fp67.2.10.fp77.2.10.fp87.2.10.fp9 |
7.2.10.fp14 |
com.liferay.portal:com.liferay.util.javaMaven |
before 7.9.0, plus listed versions 1.0.02.0.02.0.12.1.02.2.0 Show 45 moreShow less2.2.12.2.22.3.02.3.12.4.02.5.02.5.12.5.102.5.112.5.122.5.132.5.142.5.152.5.162.5.172.5.182.5.192.5.22.5.202.5.212.5.222.5.232.5.242.5.252.5.262.5.272.5.282.5.292.5.32.5.302.5.312.5.322.5.332.5.342.5.352.5.362.5.42.5.52.5.62.5.72.5.82.5.92.6.02.6.12.6.2 |
7.9.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-28977 is a medium vulnerability (CVSS 6.1) in Liferay Dxp, published September 22, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.60%, the 48th percentile. Fixed in com.liferay.portal:release.portal.bom 7.4.3.4-ga4.
References
portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-28977-htmlutil.escaperedirect-circumvention-with-multiple-forward-slash
nvd.nist.gov/vuln/detail/CVE-2022-28977
liferay.com
github.com/liferay/liferay-portal/commit/242e8bcabe3e8767799d3d1e6c021a75b4ada11b
Show 6 moreShow less
liferay.atlassian.net/browse/LPE-17327
liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2022-28977?p_r_p_assetEntryId=121612261&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121612261%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse
web.archive.org/web/20220922060039/https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-28977-htmlutil.escaperedirect-circumvention-with-multiple-forward-slash
Left out here: 103 versions. The JSON record has them.