GitHub Advisoryadvisory · Maven

GHSA-g44j-f8wm-6622 Liferay Portal and Liferay DXP Vulnerable to Stored XSS in the Manage Vocabulary Page

CRITICAL Published 2023-10-17 Modified 2025-08-08 Official page ↗
Aliases
CVE-2023-42629
Ecosystem
Maven
Packages
com.liferay:com.liferay.asset.categories.admin.web, com.liferay.portal:release.dxp.bom
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Weaknesses
CWE-79
Reviewed
2025-08-08

Affected packages

• Maven com.liferay:com.liferay.asset.categories.admin.web: < 5.0.87 → fixed in 5.0.87 • Maven com.liferay.portal:release.dxp.bom: >= 7.4.0, < 7.4.13.u88 → fixed in 7.4.13.u88

Description

Stored cross-site scripting (XSS) vulnerability in the manage vocabulary page in the Asset Categories Admin Web module before 5.0.87 from Liferay Portal (7.4.2 through 7.4.3.87), and Liferay DXP 7.4 before update 88 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a Vocabulary's 'description' text field.

Related

Alias · CVE (1)

  • CVE-2023-42629 Stored cross-site scripting (XSS) vulnerability in the manage vocabulary page in Liferay Portal 7.4.2 through 7.4.3.87, and Liferay DXP 7.4… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References