{"id":"CVE-2024-25608","published":"2024-02-20T09:26:10Z","modified":"2024-08-01T23:44:09Z","title":"HtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.18, and older unsupported versions, and Liferay DXP 7.4…","vendor":"Liferay","product":"Portal","tier":"core","eol":null,"affectedVersions":[{"vendor":"Liferay","product":"Portal","versions":[">= 7.2.0, <= 7.4.3.18"]},{"vendor":"Liferay","product":"DXP","versions":[">= 7.4.13, <= 7.4.13.u18",">= 7.3.10, <= 7.3.10-dxp-3",">= 7.2.10, <= 7.2.10-dxp-18"]}],"description":{"text":"HtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.18, and older unsupported versions, and Liferay DXP 7.4 before update 19, 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions can be circumvented by using the 'REPLACEMENT CHARACTER' (U+FFFD), which allows remote attackers to redirect users to arbitrary external URLs via the (1) 'redirect` parameter (2) `FORWARD_URL` parameter, (3) `noSuchEntryRedirect` parameter, and (4) others parameters that rely on HtmlUtil.escapeRedirect.","provenance":"source","from":"CVE.org"},"summary":null,"cvss":{"score":6.1,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00968,"percentile":0.61788,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2025-01-29","exploitedFirstSeen":"2025-01-29","ransomware":false,"evidence":[{"url":"https://cofense.com/blog/threat-actors-exploit-government-website-vulnerabilities-for-phishing-campaigns","date":"2025-01-29"},{"url":"https://app.crowdsec.net/cti/cve-explorer/CVE-2024-25608","date":"2026-01-14"}],"evidenceTotal":2,"provenance":"source"},"exploited":true,"otx":{"pulseCount":3,"pulses":[{"name":"Threat Actors Exploit Government Website Vulnerabilities for Phishing Campaigns","url":"https://otx.alienvault.com/pulse/67a1911407ba3040c3490e01","created":"2025-02-04"},{"name":"Threat Actors Exploit Government Website Vulnerabilities for Phishing Campaigns","url":"https://otx.alienvault.com/pulse/67a06a3041f712cfbabb7894","created":"2025-02-03"},{"name":"Threat Actors Exploit Government Website Vulnerabilities for Phishing Campaigns","url":"https://otx.alienvault.com/pulse/679a65e7173b80f7bb34529f","created":"2025-01-29"}],"provenance":"machine"},"cwes":[{"id":"CWE-601","name":"URL Redirection to Untrusted Site"}],"references":[{"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25608","tags":["vendor-advisory"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Maven","package":"com.liferay.portal:release.portal.bom","vulnerableRanges":[">=7.2.0, <7.4.3.19-ga19"],"patched":["7.4.3.19-ga19"],"from":["GHSA-548x-j6x6-hcv4"],"provenance":"source"},{"ecosystem":"Maven","package":"com.liferay.portal:release.dxp.bom","vulnerableRanges":["<7.2.10.fp19",">=7.3.0, <7.3.10.u4",">=7.4.0, <7.4.13.u19"],"patched":["7.2.10.fp19","7.3.10.u4","7.4.13.u19"],"from":["GHSA-548x-j6x6-hcv4"],"provenance":"source"}],"advisories":[{"id":"GHSA-548x-j6x6-hcv4","url":"https://github.com/advisories/GHSA-548x-j6x6-hcv4","severity":"MODERATE","ecosystem":"Maven","package":"com.liferay.portal:release.portal.bom","vulnerableRanges":[">=7.2.0, <7.4.3.19-ga19"],"patched":["7.4.3.19-ga19"],"provenance":"source","from":"GHSA"},{"id":"GHSA-548x-j6x6-hcv4","url":"https://github.com/advisories/GHSA-548x-j6x6-hcv4","severity":"MODERATE","ecosystem":"Maven","package":"com.liferay.portal:release.dxp.bom","vulnerableRanges":["<7.2.10.fp19"],"patched":["7.2.10.fp19"],"provenance":"source","from":"GHSA"},{"id":"GHSA-548x-j6x6-hcv4","url":"https://github.com/advisories/GHSA-548x-j6x6-hcv4","severity":"MODERATE","ecosystem":"Maven","package":"com.liferay.portal:release.dxp.bom","vulnerableRanges":[">=7.3.0, <7.3.10.u4"],"patched":["7.3.10.u4"],"provenance":"source","from":"GHSA"},{"id":"GHSA-548x-j6x6-hcv4","url":"https://github.com/advisories/GHSA-548x-j6x6-hcv4","severity":"MODERATE","ecosystem":"Maven","package":"com.liferay.portal:release.dxp.bom","vulnerableRanges":[">=7.4.0, <7.4.13.u19"],"patched":["7.4.13.u19"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2024-22931","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-22931","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"nuclei":[{"id":"CVE-2024-25608","name":"Liferay Portal - Open Redirect","severity":"medium","path":"http/cves/2024/CVE-2024-25608.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-25608.yaml"}],"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2024-02-20","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2024-25608","provenance":"source"},{"date":"2025-01-29","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://cofense.com/blog/threat-actors-exploit-government-website-vulnerabilities-for-phishing-campaigns","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":58.0,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 640 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":12.36,"detail":"percentile 0.6179"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 nuclei template"},{"name":"Mentioned in OTX pulses","points":1.37,"detail":"3 pulses"},{"name":"CVSS severity","points":4.27,"detail":"base score 6.1"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-liferay-portal-cve-2022-28977","parents":[{"from":"CVE-2022-28977","to":"CVE-2024-25608","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["portal-impl/src/com/liferay/portal/util/PortalImpl.java"],"commits":["https://github.com/liferay/liferay-portal/commit/242e8bcabe3e8767799d3d1e6c021a75b4ada11b","https://github.com/liferay/liferay-portal/commit/6389885476414d3cd9e3092b4708906a5bdc8a48","https://github.com/liferay/liferay-portal/commit/36adf82ef7a09c7035d4f19a1982dcde1ae3f6ae","https://github.com/liferay/liferay-portal/commit/aea651fa5110934b6a00d93391fac87985e27786"],"basis":"shared function","functions":["escapeRedirect"]},{"kind":"similar","provenance":"machine","score":0.78,"basis":"same package + description similarity"}]}],"children":[{"from":"CVE-2024-25608","to":"CVE-2024-25609","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["portal-impl/src/com/liferay/portal/util/PortalImpl.java"],"commits":["https://github.com/liferay/liferay-portal/commit/36adf82ef7a09c7035d4f19a1982dcde1ae3f6ae","https://github.com/liferay/liferay-portal/commit/aea651fa5110934b6a00d93391fac87985e27786","https://github.com/liferay/liferay-portal/commit/5c9655c941b18d8948a0c38b2bc84f4a1f83543a","https://github.com/liferay/liferay-portal/commit/3c5ee2054b44e4354cd2e53782914157ef2b5362"],"basis":"shared function","functions":["escapeRedirect"]},{"kind":"similar","provenance":"machine","score":0.84,"basis":"same product + CWE + description similarity"}]}],"packageHistory":[{"cve":"CVE-2024-25607","published":"2024-02-20","fixed":"7.4.13.u16","kev":false},{"cve":"CVE-2022-42117","published":"2022-10-18","fixed":"7.4.13.u17","kev":false},{"cve":"CVE-2022-42120","published":"2022-11-15","fixed":"7.4.13.u17","kev":false,"link":{"from":"CVE-2022-42120","to":"CVE-2024-25608","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:com.liferay.portal:release.dxp.bom","fromFixed":"7.4.13.u17","toFixed":"7.4.13.u19","daysApart":462}]}},{"cve":"CVE-2024-25608","published":"2024-02-20","fixed":"7.4.13.u19","kev":false},{"cve":"CVE-2022-42112","published":"2022-10-18","fixed":"7.4.13.u25","kev":false},{"cve":"CVE-2024-26267","published":"2024-02-20","fixed":"7.4.13.u26","kev":false,"link":{"from":"CVE-2024-25608","to":"CVE-2024-26267","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:com.liferay.portal:release.portal.bom","fromFixed":"7.4.3.19-ga19","toFixed":"7.4.3.26-ga26","daysApart":0}]}},{"cve":"CVE-2024-25144","published":"2024-02-08","fixed":"7.4.13.u27","kev":false}],"package":"Maven:com.liferay.portal:release.dxp.bom"}}