CVE-2021-33331: 
Java vulnerability analysis and mitigation

Open redirect vulnerability (CVE-2021-33331) was discovered in the Notifications module of Liferay Portal versions 7.0.0 through 7.3.1, and Liferay DXP 7.0 before fix pack 94, 7.1 before fix pack 19, and 7.2 before fix pack 8. The vulnerability was disclosed on August 3, 2021, and allows remote attackers to redirect users to arbitrary external URLs via the 'redirect' parameter (NVD).

The vulnerability exists in the Notifications module where the application fails to properly validate the 'redirect' parameter. When exploiting this vulnerability, an attacker can manipulate the redirect parameter in notification links to redirect users to arbitrary external websites. The vulnerability has been assigned a CVSS v3.1 Base Score of 6.1 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (NVD).

The vulnerability allows attackers to redirect users to malicious external websites, which could be used in phishing attacks or to deliver malware. The impact is considered medium severity as it requires user interaction and can potentially lead to information disclosure and social engineering attacks (NVD).

The vulnerability has been patched in various versions of Liferay software. Users should upgrade to Liferay DXP 7.0 fix pack 94 or later, 7.1 fix pack 19 or later, or 7.2 fix pack 8 or later. For Liferay Portal users, versions after 7.3.1 contain the fix (NVD).