PT-2023-28374 · Liferay · Liferay Dxp+1
Amin Achour
·
Published
2023-10-17
·
Updated
2024-01-31
·
CVE-2023-42497
CVSS v3.1
9.6
Critical
| Vector | AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Liferay Portal versions 7.4.3.4 through 7.4.3.85
Liferay DXP 7.4 before update 86
Description
A reflected cross-site scripting (XSS) issue exists on the Export for Translation page, allowing remote attackers to inject arbitrary web script or HTML via the
com liferay translation web internal portlet TranslationPortlet redirect parameter. This enables attackers to execute malicious scripts in the context of the victim's browser.Recommendations
For Liferay Portal versions 7.4.3.4 through 7.4.3.85, update to a version after 7.4.3.85 to resolve the issue.
For Liferay DXP 7.4 before update 86, apply update 86 or later to fix the vulnerability.
As a temporary workaround, consider restricting access to the Export for Translation page and the
com liferay translation web internal portlet TranslationPortlet redirect parameter until a patch is available.Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Liferay Dxp
Liferay Portal