CVE-2023-5190: 
Java vulnerability analysis and mitigation

CVE-2023-5190 is an open redirect vulnerability discovered in Liferay Portal and Liferay DXP platforms. The vulnerability affects Liferay Portal versions 7.4.3.45 through 7.4.3.101, Liferay DXP 2023.Q3 before patch 6, and Liferay DXP 7.4 updates 45 through 92. The issue was reported by Amin ACHOUR and was publicly disclosed on February 20, 2024 (Liferay Advisory).

The vulnerability exists in the Countries Management's edit region page, specifically involving the _com_liferay_address_web_internal_portlet_CountriesManagementAdminPortlet_redirect parameter. It has been assigned a CVSS v3.1 base score of 6.1 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The vulnerability is classified as CWE-601 (URL Redirection to Untrusted Site) (NVD).

The vulnerability allows remote attackers to redirect users to arbitrary external URLs. This type of vulnerability can be exploited for phishing attacks by redirecting users to malicious websites, potentially leading to credential theft or malware distribution (Liferay Advisory).

The vulnerability requires no authentication (PR:N) and has low attack complexity (AC:L), though it does require user interaction (UI:R) to be exploited. The attack can be initiated from the network (AV:N), making it remotely exploitable (NVD).

The vulnerability has been fixed in Liferay Portal version 7.4.3.102 and Liferay DXP 2023.Q3.6. Users are advised to upgrade to these or later versions to mitigate the vulnerability (Liferay Advisory).