CVE-2024-25609
CVSS 3.1 Score 6.1 of 10 (medium)
Details
Summary
CVE-2024-25609 is a new vulnerability affecting Liferay Portal versions 7.2.0 through 7.4.3.12 and older unsupported versions, as well as Liferay DXP before update 9, 7.3 service pack 3, and 7.2 fix packs 15 through 18, and older unsupported versions. This issue stems from an incomplete fix in CVE-2022-28977 and allows remote attackers to bypass HtmlUtil.escapeRedirect, which normally prevents malicious redirection to external URLs. The vulnerability can be exploited using multiple parameters, including 'redirect', 'FORWARD_URL', and others that rely on HtmlUtil.escapeRedirect. Attackers can redirect users to arbitrary external URLs, potentially leading to phishing, data theft, or other cyberattacks. Users are advised to update their Liferay installations as soon as possible to mitigate this risk.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions