Headline
CVE-2023-42628: CVE-2023-42628 XSS with child wiki pages - Liferay
Stored cross-site scripting (XSS) vulnerability in the Wiki widget in Liferay Portal 7.1.0 through 7.4.3.87, and Liferay DXP 7.0 fix pack 83 through 102, 7.1 fix pack 28 and earlier, 7.2 fix pack 20 and earlier, 7.3 update 33 and earlier, and 7.4 before update 88 allows remote attackers to inject arbitrary web script or HTML into a parent wiki page via a crafted payload injected into a wiki page’s ‘Content’ text field.
This website uses cookies to ensure you get the best experience. Learn More.
Accept
- Ask
- Blogs
- Chat
- Download
- Feedback
- Help
- Learn
- Projects
- /dev/24
- Log In
Known Vulnerabilities
- Overview
- Reporting Security Issues
- Known Vulnerabilities
- Hall of Fame
Releases
Liferay Portal 7.4
Liferay Portal 7.3
Liferay Portal 7.2
Liferay Portal 7.1
Liferay Portal 7.0
Liferay Portal 6.2 CE
Liferay Faces
Liferay DXP 7.4
Liferay DXP 7.3
Liferay DXP 7.2
LIferay DXP 7.1
LIferay DXP 7.0
CVE-2023-42628 XSS with child wiki pages
Description
Stored cross-site scripting (XSS) vulnerability in the Wiki widget in Liferay Portal and Liferay DXP allows remote attackers to inject arbitrary web script or HTML into a parent wiki page via a crafted payload injected into a wiki page’s ‘Content’ text field.
Severity
9.0 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H)
Affected Version(s)
- Liferay DXP 7.0 fix pack 83 and above
- Liferay DXP 7.1
- Liferay DXP 7.2
- Liferay DXP 7.3
- Liferay DXP 7.4 before update 88
- Liferay Portal 7.1.0 through 7.4.3.87
Fixed Version(s)
- Liferay DXP 7.4 update 88
- Liferay Portal 7.4.3.88
Acknowledgments
This issue was reported by Michael Oelke
Publication date: Fri, 13 Oct 2023 11:50:00 +0000
Security advisories for Liferay’s enterprise offerings (e.g., Liferay DXP) are only listed here since 2023. Historial advisories are availabe in the Help Center.