CVE-2023-44308

MEDIUM

Liferay Digital Experience Platform - Open Redirect via Adaptive Media Administration Page

Title source: llm

Description

Open redirect vulnerability in adaptive media administration page in Liferay DXP 2023.Q3 before patch 6, and 7.4 GA through update 92 allows remote attackers to redirect users to arbitrary external URLs via the _com_liferay_adaptive_media_web_portlet_AMPortlet_redirect parameter.

References (1)

Core 1

Core References

Vendor Advisory vendor-advisory

https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-44308

Scores

CVSS v3 6.1

EPSS 0.0019

EPSS Percentile 40.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-601

Status published

Products (2)

com.liferay/com.liferay.adaptive.media.web 2023.Q3 - 2023.Q3.6Maven

liferay/digital_experience_platform 7.4 (49 CPE variants)

Published Feb 20, 2024

Tracked Since Feb 18, 2026