PT-2023-24583 · Liferay · Plugin For Oauth 2.0+2

Published 2023-05-24 · Updated 2024-01-31 · CVE-2023-33941

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.4.3.41 through 7.4.3.52 Liferay DXP 7.4 update 41 through 52

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities in the Plugin for OAuth 2.0 module's OAuth2ProviderApplicationRedirect class. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the code or error parameters.

Recommendations For Liferay Portal versions 7.4.3.41 through 7.4.3.52, update to a version outside of this range to resolve the issue. For Liferay DXP 7.4 update 41 through 52, update to a version outside of this range to resolve the issue. As a temporary workaround, consider restricting access to the OAuth2ProviderApplicationRedirect class until a patch is available. Avoid using the code and error parameters in the affected module until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-LIFERAY-2023-33941

CVE-2023-33941

GHSA-MVFV-W3FQ-XP67

Affected Products

Liferay Dxp

Liferay Portal

Plugin For Oauth 2.0

References · 7

• https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33941 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-liferay-2023-33941 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-33941 · Security Note
• https://osv.dev/vulnerability/CVE-2023-33941 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mvfv-w3fq-xp67 · Vendor Advisory
• https://github.com/liferay/liferay-portal · Note
• https://t.me/cibsecurity/72412 · Telegram Post