CVE-2023-35029 — Liferay / Portal

Description (CNA)

Open redirect vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.76, and Liferay DXP 7.4 update 70 through 76 allows remote attackers to redirect users to arbitrary external URLs via the `_com_liferay_layout_admin_web_portlet_GroupPagesPortlet_backURL` parameter.

Affected (CNA)

Vendor / product	Versions
Liferay / Portal	affected 7.4.3.70 through 7.4.3.76
Liferay / DXP	affected 7.4.13.u70 through 7.4.13.u76

CWE

CWE-601

References

https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-35029

ADP enrichment

CVE

No English description supplied.

https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-35029

CISA-ADP

No English description supplied.

No references supplied.