GitHub Advisoryadvisory · Maven

GHSA-j663-6jpj-xx8c Liferay Portal and Liferay DXP Vulnerable to XSS in the Fragment Components

CRITICAL Published 2023-10-17 Modified 2025-08-08 Official page ↗
Aliases
CVE-2023-44309
Ecosystem
Maven
Packages
com.liferay:com.liferay.fragment.entry.processor.impl, com.liferay.portal:release.dxp.bom
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Weaknesses
CWE-79
Reviewed
2025-08-08

Affected packages

• Maven com.liferay:com.liferay.fragment.entry.processor.impl: < 3.0.25 → fixed in 3.0.25 • Maven com.liferay.portal:release.dxp.bom: >= 7.4.0, < 7.4.13.u54 → fixed in 7.4.13.u54

Description

Multiple stored cross-site scripting (XSS) vulnerabilities in the fragment components before 3.0.25 from Liferay Portal (7.4.2 through 7.4.3.53), and Liferay DXP 7.4 before update 54 allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into any non-HTML field of a linked source asset.

Related

Alias · CVE (1)

  • CVE-2023-44309 Multiple stored cross-site scripting (XSS) vulnerabilities in the fragment components in Liferay Portal 7.4.2 through 7.4.3.53, and Liferay… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References