PT-2023-24584 · Liferay · Liferay Dxp+1

CVE-2023-33942 · Publicado 2023-05-24 · Atualizado 2024-01-31

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.4.3.50 Liferay DXP 7.4 update 50

Description A cross-site scripting (XSS) issue exists in the Web Content Display widget's article selector, allowing remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a web content article's Title field.

Recommendations For Liferay Portal version 7.4.3.50, consider disabling the Web Content Display widget until a patch is available. For Liferay DXP 7.4 update 50, restrict access to the article selector in the Web Content Display widget to minimize the risk of exploitation. Avoid using the Title field in web content articles until the issue is resolved.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BIT-LIFERAY-2023-33942

CVE-2023-33942

GHSA-WV99-WMPF-JRQR

Produtos afetados

Liferay Dxp

Liferay Portal

Referências · 7

• https://github.com/liferay/liferay-portal · Nota
• https://osv.dev/vulnerability/BIT-liferay-2023-33942 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-33942 · Nota de Segurança
• https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33942 · Aviso do Fabricante
• https://t.me/cvenotify/51519 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-33942 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-wv99-wmpf-jrqr · Aviso do Fabricante