Liferay Vulnerable to Open Redirect via Adaptive Media Administration Page

MEDIUM 6.1CVE-2023-44308 · GHSA-3mrr-cw9q-727m · Published 20/02/2024 · updated 17/06/2026

In short

CVE-2023-44308 is a MEDIUM (CVSS 6.1) vulnerability affecting com.liferay:com.liferay.adaptive.media.web, digital experience platform (liferay).
Chance of exploitation in the next 30 days (EPSS): 0.39%, higher than 32.6% of all vulnerabilities.
Fix: update to 2023.Q3.6 or later.

Package	Affected versions	Patched versions
com.liferay:com.liferay.adaptive.media.web Maven	`≥ 2023.Q3, < 2023.Q3.6≥ 7.4.0, ≤ 7.4.13.u92`	`2023.Q3.6`
digital experience platform liferay	`= 2023.q3.0= 2023.q3.1= 2023.q3.2= 2023.q3.3= 2023.q3.4= 2023.q3.5= 7.4`	No fix yet

Description

Open redirect vulnerability in adaptive media administration page in Liferay DXP 2023.Q3 before patch 6, and 7.4 GA through update 92 allows remote attackers to redirect users to arbitrary external URLs via the _com_liferay_adaptive_media_web_portlet_AMPortlet_redirect parameter.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2023-44308 · ADVISORY
liferay/liferay-portal · PACKAGE
liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-44308 · WEB

More vulnerabilities in com.liferay:com.liferay.adaptive.media.web

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

com.liferay:com.liferay.adaptive.media.web

Maven

≥ 2023.Q3, < 2023.Q3.6≥ 7.4.0, ≤ 7.4.13.u92

2023.Q3.6

digital experience platform

liferay

= 2023.q3.0= 2023.q3.1= 2023.q3.2= 2023.q3.3= 2023.q3.4= 2023.q3.5= 7.4

No fix yet

Description

NVD description