CVE-2024-25608
Liferay Portal and Liferay DXP's HtmlUtil.escapeRedirect Can Be Circumvented via Replacement Character
HtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.18, and older unsupported versions, and Liferay DXP 7.4 before update 19, 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions can be circumvented by using the 'REPLACEMENT CHARACTER' (U+FFFD), which allows remote attackers to redirect users to arbitrary external URLs via the (1) 'redirectparameter (2)FORWARD_URLparameter, (3)noSuchEntryRedirect` parameter, and (4) others parameters that rely on HtmlUtil.escapeRedirect.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
HtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.18, and older unsupported versions, and Liferay DXP 7.4 before update 19, 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions can be circumvented by using the 'REPLACEMENT CHARACTER' (U+FFFD), which allows remote attackers to redirect users to arbitrary external URLs via the (1) 'redirectparameter (2)FORWARD_URLparameter, (3)noSuchEntryRedirect` parameter, and (4) others parameters that rely on HtmlUtil.escapeRedirect.
- Record
CVE-2024-25608- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
EUVDEUVD-2024-22931
HtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.18, and older unsupported versions, and Liferay DXP 7.4 before update 19, 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions can be circumvented by using the 'REPLACEMENT CHARACTER' (U+FFFD), which allows remote attackers to redirect users to arbitrary external URLs via the (1) 'redirectparameter (2)FORWARD_URLparameter, (3)noSuchEntryRedirect` parameter, and (4) others parameters that rely on HtmlUtil.escapeRedirect.
- Record
EUVD-2024-22931- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-548x-j6x6-hcv4
Liferay Portal and Liferay DXP's HtmlUtil.escapeRedirect Can Be Circumvented via Replacement Character
HtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.18, and older unsupported versions, and Liferay DXP 7.4 before update 19, 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions can be circumvented by using the 'REPLACEMENT CHARACTER' (U+FFFD), which allows remote attackers to redirect users to arbitrary external URLs via the (1) 'redirectparameter (2)FORWARD_URLparameter, (3)noSuchEntryRedirect` parameter, and (4) others parameters that rely on HtmlUtil.escapeRedirect.
- Record
GHSA-548x-j6x6-hcv4- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
NVD
HtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.18, and older unsupported versions, and Liferay DXP 7.4 before update 19, 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions can be circumvented by using the 'REPLACEMENT CHARACTER' (U+FFFD), which allows remote attackers to redirect users to arbitrary external URLs via the (1) 'redirectparameter (2)FORWARD_URLparameter, (3)noSuchEntryRedirect` parameter, and (4) others parameters that rely on HtmlUtil.escapeRedirect.
- Record
CVE-2024-25608- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
OSV
HtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.18, and older unsupported versions, and Liferay DXP 7.4 before update 19, 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions can be circumvented by using the 'REPLACEMENT CHARACTER' (U+FFFD), which allows remote attackers to redirect users to arbitrary external URLs via the (1) 'redirectparameter (2)FORWARD_URLparameter, (3)noSuchEntryRedirect` parameter, and (4) others parameters that rely on HtmlUtil.escapeRedirect.
- Record
CVE-2024-25608- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-548x-j6x6-hcv4
Liferay Portal and Liferay DXP's HtmlUtil.escapeRedirect Can Be Circumvented via Replacement Character
HtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.18, and older unsupported versions, and Liferay DXP 7.4 before update 19, 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions can be circumvented by using the 'REPLACEMENT CHARACTER' (U+FFFD), which allows remote attackers to redirect users to arbitrary external URLs via the (1) 'redirectparameter (2)FORWARD_URLparameter, (3)noSuchEntryRedirect` parameter, and (4) others parameters that rely on HtmlUtil.escapeRedirect.
- Record
GHSA-548x-j6x6-hcv4- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
com.liferay.portal:release.portal.bomMaven | 7.2.0 up to 7.4.3.19-ga19 | 7.4.3.19-ga19 |
com.liferay.portal:release.dxp.bomMaven | before 7.2.10.fp19 | 7.2.10.fp19 |
com.liferay.portal:release.dxp.bomMaven | 7.3.0 up to 7.3.10.u4 | 7.3.10.u4 |
com.liferay.portal:release.dxp.bomMaven | 7.4.0 up to 7.4.13.u19 | 7.4.13.u19 |
com.liferay.portal:release.portal.bomMaven | 7.2.0 up to 7.4.3.19-ga19, plus listed versions 7.2.17.2.1-17.3.07.3.0-17.3.1 Show 30 moreShow less7.3.1-17.3.27.3.2-17.3.37.3.3-17.3.47.3.57.3.67.3.77.4.07.4.17.4.1-17.4.27.4.2-17.4.3.107.4.3.117.4.3.127.4.3.137.4.3.147.4.3.157.4.3.167.4.3.177.4.3.187.4.3.197.4.3.47.4.3.57.4.3.67.4.3.77.4.3.87.4.3.9 | 7.4.3.19-ga19 |
com.liferay.portal:release.dxp.bomMaven | before 7.2.10.fp19, plus listed versions 7.0.10.147.0.10.14-17.0.10.167.0.10.177.0.10.7 Show 45 moreShow less7.0.10.87.0.10.97.0.10.fp1007.0.10.fp1017.0.10.fp1027.0.10.fp607.0.10.fp617.0.10.fp627.0.10.fp637.0.10.fp647.0.10.fp657.0.10.fp667.0.10.fp677.0.10.fp687.0.10.fp697.0.10.fp707.0.10.fp717.0.10.fp727.0.10.fp737.0.10.fp747.0.10.fp757.0.10.fp767.0.10.fp777.0.10.fp787.0.10.fp797.0.10.fp807.0.10.fp817.0.10.fp827.0.10.fp837.0.10.fp847.0.10.fp857.0.10.fp85-17.0.10.fp867.0.10.fp86-17.0.10.fp877.0.10.fp87-17.0.10.fp887.0.10.fp897.0.10.fp907.0.10.fp917.0.10.fp927.0.10.fp947.0.10.fp94-17.0.10.fp957.0.10.fp95-1 | 7.2.10.fp19 |
com.liferay.portal:release.dxp.bomMaven | 7.3.0 up to 7.3.10.u4, plus listed versions 7.3.107.3.10.ep37.3.10.ep47.3.10.ep57.3.10.fp17.3.10.fp2 | 7.3.10.u4 |
com.liferay.portal:release.dxp.bomMaven | 7.4.0 up to 7.4.13.u19, plus listed versions 7.4.10.ep17.4.117.4.127.4.137.4.13.u1 Show 13 moreShow less7.4.13.u107.4.13.u157.4.13.u167.4.13.u177.4.13.u187.4.13.u27.4.13.u37.4.13.u47.4.13.u57.4.13.u67.4.13.u77.4.13.u87.4.13.u9 | 7.4.13.u19 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Nuclei | Liferay Portal - Open Redirect |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, Nuclei, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-25608 is a medium vulnerability (CVSS 6.1) in Liferay Dxp, published February 20, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.97%, the 62nd percentile. Fixed in com.liferay.portal:release.portal.bom 7.4.3.19-ga19.
References
liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25608
nvd.nist.gov/vuln/detail/CVE-2024-25608
github.com/liferay/liferay-portal/commit/36adf82ef7a09c7035d4f19a1982dcde1ae3f6ae
Left out here: 58 versions. The JSON record has them.