Vulnerability · Published Feb 21, 2024 · Assigned by Liferay
CVE-2023-42498
Critical 9.6
In plain English
A critical-severity cross-site scripting in DXP from Liferay. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Reflected cross-site scripting (XSS) vulnerability in the Language Override edit screen in Liferay Portal 7.4.3.8 through 7.4.3.97, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 4 through 92 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_portal_language_override_web_internal_portlet_PLOPortlet_key parameter.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | com.liferay.portal:release.dxp.bom | 2023.Q3.5 | GHSA-73x3-8mrg-5r93 |
| Maven | com.liferay.portal:release.dxp.bom | no fix listed | GHSA-73x3-8mrg-5r93 |
| Maven | com.liferay.portal:release.portal.bom | 7.4.3.98 | GHSA-73x3-8mrg-5r93 |
Affected products (as reported)
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H