Headline

CVE-2023-33944: CVE-2023-33944 XSS with container layout fragment URL - Liferay

Cross-site scripting (XSS) vulnerability in Layout module in Liferay Portal 7.3.4 through 7.4.3.68, and Liferay DXP 7.3 before update 24, and 7.4 before update 69 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a container type layout fragment’s URL text field.

1 year ago

CVE

Open in Source

#xss #vulnerability #web

This website uses cookies to ensure you get the best experience. Learn More.

Ask
Blogs
Download
Feedback
Help
Learn
Projects
/dev/24
Log In

Known Vulnerabilities

Overview
Reporting Security Issues
Known Vulnerabilities
Hall of Fame

Releases

Liferay Portal 7.4
Liferay Portal 7.3
Liferay Portal 7.2
Liferay Portal 7.1
Liferay Portal 7.0
Liferay Portal 6.2 CE
Liferay Faces
Liferay DXP 7.4
Liferay DXP 7.3
Liferay DXP 7.2
LIferay DXP 7.1
LIferay DXP 7.0

CVE-2023-33944 XSS with container layout fragment URL

Description

Cross-site scripting (XSS) vulnerability in Layout module in Liferay Portal and Liferay DXP allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a container type layout fragment’s `URL` text field.

Severity

4.8 (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N)

Affected Version(s)

Liferay DXP 7.3 before update 24
Liferay DXP 7.4 before update 69
Liferay Portal 7.3.4 - 7.3.7
Liferay Portal 7.4.0 - 7.4.3.68

Fixed Version(s)

Liferay DXP 7.3 update 24
Liferay DXP 7.4 update 69
Liferay Portal 7.4.3.69

Publication date: Wed, 24 May 2023 07:00:00 +0000

Security advisories for Liferay’s enterprise offerings (e.g., Liferay DXP) are only listed here since 2023. Historial advisories are availabe in the Help Center.