PT-2023-28374 · Liferay · Liferay Dxp+1
Amin Achour
·
Publicado
2023-10-17
·
Atualizado
2024-01-31
·
CVE-2023-42497
CVSS v3.1
9.6
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Liferay Portal versions 7.4.3.4 through 7.4.3.85
Liferay DXP 7.4 before update 86
Description
A reflected cross-site scripting (XSS) issue exists on the Export for Translation page, allowing remote attackers to inject arbitrary web script or HTML via the
com liferay translation web internal portlet TranslationPortlet redirect parameter. This enables attackers to execute malicious scripts in the context of the victim's browser.Recommendations
For Liferay Portal versions 7.4.3.4 through 7.4.3.85, update to a version after 7.4.3.85 to resolve the issue.
For Liferay DXP 7.4 before update 86, apply update 86 or later to fix the vulnerability.
As a temporary workaround, consider restricting access to the Export for Translation page and the
com liferay translation web internal portlet TranslationPortlet redirect parameter until a patch is available.Correção
XSS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Liferay Dxp
Liferay Portal