PT-2023-29204 · Liferay · Liferay Dxp+1
Publicado
2023-10-17
·
Atualizado
2024-01-31
·
CVE-2023-44310
CVSS v3.1
9.0
Crítica
| Vetor | AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Liferay Portal versions 7.3.6 through 7.4.3.78
Liferay DXP versions 7.3 fix pack 1 through update 23
Liferay DXP version 7.4 before update 79
Description
A stored cross-site scripting (XSS) issue in the Page Tree menu allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a page's
Name text field.Recommendations
For Liferay Portal versions 7.3.6 through 7.4.3.78, update to a version after 7.4.3.78 to resolve the issue.
For Liferay DXP versions 7.3 fix pack 1 through update 23, update to update 24 or later to resolve the issue.
For Liferay DXP version 7.4 before update 79, update to update 79 or later to resolve the issue.
As a temporary workaround, consider restricting access to the Page Tree menu until a patch is available.
Avoid using the
Name text field in the Page Tree menu until the issue is resolved.Correção
XSS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Liferay Dxp
Liferay Portal