PT-2023-23529 · Liferay · Liferay Dxp+1
Henrik Bayer
+1
·
Publicado
2023-06-15
·
Atualizado
2026-01-09
·
CVE-2023-3193
CVSS v3.1
6.1
Média
| Vetor | AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Liferay Portal versions 7.4.3.70 through 7.4.3.73
Liferay DXP 7.4 update 70 through 73
Description
A cross-site scripting (XSS) issue exists in the Layout module's SEO configuration, allowing remote attackers to inject arbitrary web script or HTML via the
com liferay layout admin web portlet GroupPagesPortlet backURL parameter. This enables attackers to execute malicious scripts on the victim's browser.Recommendations
For Liferay Portal versions 7.4.3.70 through 7.4.3.73, restrict access to the Layout module's SEO configuration until a patch is available.
For Liferay DXP 7.4 update 70 through 73, avoid using the
com liferay layout admin web portlet GroupPagesPortlet backURL parameter in the affected API endpoint until the issue is resolved.
As a temporary workaround, consider disabling the SEO configuration in the Layout module to minimize the risk of exploitation.Correção
XSS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Liferay Dxp
Liferay Portal