CVE-2023-5190: Open Redirect Vulnerability in Liferay Portal and Liferay DXP
Summary
CVE-2023-5190: Liferay Portal and Liferay DXP Vulnerable to Open Redirect in Countries Management's Edit Region Page. Affects com.liferay.portal:release.portal.bom versions >= 7.4.3.45-ga45, < 7.4.3.102-ga102. Fixed in 7.4.3.102-ga102. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Liferay Portal and Liferay DXP are powerful platforms designed for building and managing web applications and digital experiences. They provide a range of features including content management, collaboration tools, and user management. However, certain versions of these platforms are susceptible to an open redirect vulnerability, which can allow attackers to redirect users to malicious external URLs.
Vulnerability Detail
The open redirect vulnerability exists in the Countries Management's edit region page of Liferay Portal versions 7.4.3.45 through 7.4.3.101 and Liferay DXP 2023.Q3 prior to patch 6. This vulnerability allows remote attackers to manipulate the _com_liferay_address_web_internal_portlet_CountriesManagementAdminPortlet_redirect parameter, potentially redirecting users to arbitrary external URLs. This could lead to phishing attacks or other malicious activities, compromising user security and trust.
How To Fix
Latest published version: 7.4.3.132 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.4.3.102-ga102
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that user input for the redirect parameter is properly validated and sanitized to prevent unauthorized redirects. This can be done by implementing checks to ensure that the redirect URL is within a trusted domain.
Conclusion
CVE-2023-5190 represents a significant security risk for users of Liferay Portal and Liferay DXP. It is crucial for organizations to update their software to the latest patched versions to protect against potential exploitation. Additionally, implementing proper input validation can serve as a temporary measure to mitigate risks until updates can be applied.
See every vulnerability recorded for com.liferay.portal:release.portal.bom →
FAQ
CVE-2023-5190 is an open redirect vulnerability found in specific versions of Liferay Portal and Liferay DXP, allowing attackers to redirect users to external URLs.
The vulnerability affects Liferay Portal versions 7.4.3.45 through 7.4.3.101 and Liferay DXP 2023.Q3 before patch 6.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By simply analyzing your pom.xml file, you can check for vulnerabilities without needing to install any software.
The CVSS score for this vulnerability is 6.1, indicating a moderate severity level.
If immediate updates are not possible, implement input validation and sanitization for redirect parameters as a temporary workaround to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for com.liferay.portal:release.portal.bom.
