CVE-2022-28977: Liferay Portal and DXP HtmlUtil.escapeRedirect Vulnerability
Summary
CVE-2022-28977: Liferay Portal and Liferay DXP HtmlUtil.escapeRedirect Can Be Circumvented. Affects com.liferay.portal:release.portal.bom versions >= 7.3.1-ga2, < 7.4.3.4-ga4. Fixed in 7.4.3.4-ga4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Liferay Portal is a popular open-source platform for building web applications and managing content. It provides a robust set of features for creating and managing websites, intranets, and other digital experiences. Liferay DXP is an enterprise version that offers additional capabilities for businesses. The vulnerability in question affects the HtmlUtil.escapeRedirect function, which is responsible for sanitizing redirect URLs. This flaw allows attackers to exploit the function and redirect users to malicious external sites.
Vulnerability Detail
The vulnerability arises from the improper handling of multiple forward slashes in the redirect URLs processed by the HtmlUtil.escapeRedirect function. This oversight allows remote attackers to bypass the intended URL validation, leading to potential phishing attacks or other malicious activities. The affected versions include Liferay Portal 7.3.1 through 7.4.2 and various fix packs of Liferay DXP, making it critical for users of these versions to address the issue promptly.
How To Fix
Latest published version: 7.4.3.132 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.4.3.4-ga4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can implement additional validation on the redirect URLs to ensure they do not contain multiple forward slashes. This can be done by adding a check in your application code before processing the redirect parameters. For example:
if (redirectUrl.contains("//")) {
// Handle invalid redirect
} else {
// Proceed with redirect
}
Conclusion
CVE-2022-28977 highlights a significant vulnerability in Liferay Portal and DXP that can lead to unauthorized redirects. Users are urged to update their installations to the latest versions to mitigate the risk. Additionally, implementing temporary workarounds can help protect against potential exploitation until updates are applied.
See every vulnerability recorded for com.liferay.portal:release.portal.bom →
FAQ
CVE-2022-28977 is a vulnerability in Liferay Portal and DXP that allows attackers to bypass URL validation, potentially redirecting users to malicious sites.
The vulnerability affects Liferay Portal versions 7.3.1 to 7.4.2 and Liferay DXP fix packs 91 to 101 for version 7.0, 17 to 25 for version 7.1, 5 to 14 for version 7.2, and before service pack 3 for version 7.3.
You can use Vulert, which monitors open-source vulnerabilities in your software using just the pom.xml file. Visit Vulert Scanner to check your application without signing up.
Update your Liferay Portal or DXP to the latest patched versions as specified in the 'how to fix' section. Ensure you modify your pom.xml file accordingly.
The CVSS score for this vulnerability is 6.1, indicating a moderate level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.liferay.portal:release.portal.bom.
