CVE-2023-5190: Medium severity liferay 7.4 ga vulnerability

Q: What is the severity of CVE-2023-5190?

CVE-2023-5190 has been classified with a high severity due to the potential for exploitation via open redirect attacks.

Q: How do I fix CVE-2023-5190?

To fix CVE-2023-5190, update your Liferay Portal to version 7.4.3.102 or later, or upgrade Liferay DXP to the latest patched version.

Q: Which versions are affected by CVE-2023-5190?

CVE-2023-5190 affects Liferay Portal versions from 7.4.3.45 through 7.4.3.101 and Liferay DXP 2023.Q3 before patch 6.

Q: What types of attacks can exploit CVE-2023-5190?

CVE-2023-5190 can be exploited to perform open redirect attacks that may lead to phishing or other malicious activities.

Q: Is CVE-2023-5190 a client-side or server-side vulnerability?

CVE-2023-5190 is a server-side vulnerability that allows attackers to manipulate redirect URLs directly on the server.

Published Feb 20, 2024

Updated

Open redirect vulnerability in the Countries Management’s edit region page in Liferay Portal 7.4.3.45 through 7.4.3.101, and Liferay DXP 2023.Q3 before patch 6, and 7.4 update 45 through 92 allows remote attackers to redirect users to arbitrary external URLs via the comliferayaddresswebinternalportletCountriesManagementAdminPortletredirect parameter.

Affected Software

61 affected componentsFixes available

Liferay portal>=7.4.3.45<=7.4.3.101

Liferay DXP<2023.Q3

Liferay portal>=7.4<7.4 update 45, >=7.4.3.45<=7.4.3.92

Liferay Digital Experience Platform=7.4-update45

Liferay Digital Experience Platform=7.4-update46

Liferay Digital Experience Platform=7.4-update47

Liferay Digital Experience Platform=7.4-update48

Liferay Digital Experience Platform=7.4-update49

Liferay Digital Experience Platform=7.4-update50

Liferay Digital Experience Platform=7.4-update51

Liferay Digital Experience Platform=7.4-update52

Liferay Digital Experience Platform=7.4-update53

Liferay Digital Experience Platform=7.4-update54

Liferay Digital Experience Platform=7.4-update55

Liferay Digital Experience Platform=7.4-update56

Liferay Digital Experience Platform=7.4-update57

Liferay Digital Experience Platform=7.4-update58

Liferay Digital Experience Platform=7.4-update59

Liferay Digital Experience Platform=7.4-update60

Liferay Digital Experience Platform=7.4-update61

Liferay Digital Experience Platform=7.4-update62

Liferay Digital Experience Platform=7.4-update63

Liferay Digital Experience Platform=7.4-update64

Liferay Digital Experience Platform=7.4-update65

Liferay Digital Experience Platform=7.4-update66

Liferay Digital Experience Platform=7.4-update67

Liferay Digital Experience Platform=7.4-update68

Liferay Digital Experience Platform=7.4-update69

Liferay Digital Experience Platform=7.4-update70

Liferay Digital Experience Platform=7.4-update71

Liferay Digital Experience Platform=7.4-update72

Liferay Digital Experience Platform=7.4-update73

Liferay Digital Experience Platform=7.4-update74

Liferay Digital Experience Platform=7.4-update75

Liferay Digital Experience Platform=7.4-update76

Liferay Digital Experience Platform=7.4-update77

Liferay Digital Experience Platform=7.4-update78

Liferay Digital Experience Platform=7.4-update79

Liferay Digital Experience Platform=7.4-update80

Liferay Digital Experience Platform=7.4-update81

Liferay Digital Experience Platform=7.4-update82

Liferay Digital Experience Platform=7.4-update83

Liferay Digital Experience Platform=7.4-update84

Liferay Digital Experience Platform=7.4-update85

Liferay Digital Experience Platform=7.4-update86

Liferay Digital Experience Platform=7.4-update87

Liferay Digital Experience Platform=7.4-update88

Liferay Digital Experience Platform=7.4-update89

Liferay Digital Experience Platform=7.4-update90

Liferay Digital Experience Platform=7.4-update91

Liferay Digital Experience Platform=7.4-update92

Liferay Digital Experience Platform=2023.q3.0

Liferay Digital Experience Platform=2023.q3.1

Liferay Digital Experience Platform=2023.q3.2

Liferay Digital Experience Platform=2023.q3.3

Liferay Digital Experience Platform=2023.q3.4

Liferay Digital Experience Platform=2023.q3.5

Liferay Liferay Portal>=7.4.3.45<7.4.3.102

maven/com.liferay.portal:release.dxp.bom>=7.4.13.u45<=7.4.13.u92

maven/com.liferay.portal:release.dxp.bom>=2023.Q3<2023.Q3.6

2023.Q3.6

maven/com.liferay.portal:release.portal.bom>=7.4.3.45-ga45<7.4.3.102-ga102

7.4.3.102-ga102

Event History

Feb 20, 2024

CVE Published

via MITRE·06:03 AM

Data Sourced

via MITRE·06:03 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·06:15 AM

DescriptionSeverityWeaknessAffected Software

Advisory Published

via GitHub·06:30 AM

Data Sourced

via GitHub·06:30 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2023-5190?

CVE-2023-5190 has been classified with a high severity due to the potential for exploitation via open redirect attacks.

How do I fix CVE-2023-5190?

To fix CVE-2023-5190, update your Liferay Portal to version 7.4.3.102 or later, or upgrade Liferay DXP to the latest patched version.

Which versions are affected by CVE-2023-5190?

CVE-2023-5190 affects Liferay Portal versions from 7.4.3.45 through 7.4.3.101 and Liferay DXP 2023.Q3 before patch 6.

What types of attacks can exploit CVE-2023-5190?

CVE-2023-5190 can be exploited to perform open redirect attacks that may lead to phishing or other malicious activities.

Is CVE-2023-5190 a client-side or server-side vulnerability?

CVE-2023-5190 is a server-side vulnerability that allows attackers to manipulate redirect URLs directly on the server.

CVE-2023-5190: Medium severity liferay 7.4 ga vulnerability

Affected Software

Event History

Frequently Asked Questions

What is the severity of CVE-2023-5190?

How do I fix CVE-2023-5190?

Which versions are affected by CVE-2023-5190?

What types of attacks can exploit CVE-2023-5190?

Is CVE-2023-5190 a client-side or server-side vulnerability?

Company

Resources

Contact