PT-2023-24585 · Liferay · Liferay Dxp+1

Publicado 2023-05-24 · Atualizado 2026-01-30 · CVE-2023-33943

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.4.3.21 through 7.4.3.62 Liferay DXP 7.4 update 21 through 62

Description A cross-site scripting (XSS) issue exists in the Account module, allowing remote attackers to inject arbitrary web script or HTML via crafted payloads in a user's First Name, Middle Name, Last Name, or Job Title text fields.

Recommendations For Liferay Portal versions 7.4.3.21 through 7.4.3.62, restrict input in the First Name, Middle Name, Last Name, and Job Title fields to prevent arbitrary web script or HTML injection until a patch is available. For Liferay DXP 7.4 update 21 through 62, consider temporarily disabling the Account module or limiting user input in the affected fields to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BIT-LIFERAY-2023-33943

CVE-2023-33943

GHSA-P9XG-9378-CQP7

Produtos afetados

Liferay Dxp

Liferay Portal

Referências · 9

• https://github.com/liferay/liferay-portal · Nota
• https://t.me/cveNotify/150456 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-33943 · Nota de Segurança
• https://t.me/cvenotify/51063 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-33943 · Aviso do Fabricante
• https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33943 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-p9xg-9378-cqp7 · Aviso do Fabricante
• https://osv.dev/vulnerability/BIT-liferay-2023-33943 · Aviso do Fabricante
• https://t.me/cvenotify/51520 · Publicação no Telegram