GitHub Advisoryadvisory · Maven

GHSA-wv99-wmpf-jrqr Cross-site scripting in Liferay Portal

MEDIUM Published 2023-05-24 Modified 2023-05-24 Official page ↗
Aliases
CVE-2023-33942
Ecosystem
Maven
Packages
com.liferay.portal:release.portal.bom
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2023-05-24

Affected packages

• Maven com.liferay.portal:release.portal.bom: >= 7.4.3.50, < 7.4.3.51 → fixed in 7.4.3.51

Description

Cross-site scripting (XSS) vulnerability in the Web Content Display widget's article selector in Liferay Liferay Portal 7.4.3.50, and Liferay DXP 7.4 update 50 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a web content article's `Title` field.

Related

Alias · CVE (1)

  • CVE-2023-33942 Cross-site scripting (XSS) vulnerability in the Web Content Display widget's article selector in Liferay Liferay Portal 7.4.3.50, and… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References