PT-2023-24586 · Liferay · Liferay Dxp+1

Published 2023-05-24 · Updated 2026-01-30 · CVE-2023-33944

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.3.4 through 7.4.3.68 Liferay DXP versions 7.3 before update 24 Liferay DXP versions 7.4 before update 69

Description A cross-site scripting (XSS) issue in the Layout module allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a container type layout fragment's URL text field. This enables attackers to execute malicious scripts on the victim's browser.

Recommendations For Liferay Portal versions 7.3.4 through 7.4.3.68, update to a version after 7.4.3.68 to resolve the issue. For Liferay DXP versions 7.3 before update 24, apply update 24 or later to fix the vulnerability. For Liferay DXP versions 7.4 before update 69, apply update 69 or later to fix the vulnerability. As a temporary workaround, consider restricting access to the Layout module's container type layout fragment to minimize the risk of exploitation. Avoid using the URL text field in the affected layout fragment until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-LIFERAY-2023-33944

CVE-2023-33944

GHSA-PFWC-4FRF-4GF8

Affected Products

Liferay Dxp

Liferay Portal

References · 9

• https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33944 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-liferay-2023-33944 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-33944 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-33944 · Security Note
• https://osv.dev/vulnerability/GHSA-pfwc-4frf-4gf8 · Vendor Advisory
• https://github.com/liferay/liferay-portal · Note
• https://t.me/cveNotify/150457 · Telegram Post
• https://t.me/cibsecurity/64693 · Telegram Post
• https://t.me/cvenotify/51065 · Telegram Post