CVE-2024-25608 Information
Feb 21, 2024
cve
Description
HtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.18 and older unsupported versions and Liferay DXP 7.4 before update 19 7.3 before update 4 7.2 before fix pack 19 and older unsupported versions can be circumvented by using the ‘REPLACEMENT CHARACTER’ (U+FFFD) which allows remote attackers to redirect users to arbitrary external URLs via the (1) ‘redirectparameter (2)FORWARD_URLparameter (3)noSuchEntryRedirect` parameter and (4) others parameters that rely on HtmlUtil.escapeRedirect.