PT-2023-28455 · Liferay · Liferay Dxp+1
Michael Oelke
·
Published
2023-10-17
·
Updated
2024-01-31
·
CVE-2023-42627
CVSS v3.1
9.6
Critical
| Vector | AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Liferay Portal versions 7.3.5 through 7.4.3.91
Liferay DXP versions 7.3 update 33 and earlier, and 7.4 before update 92
Description
Multiple stored cross-site scripting (XSS) vulnerabilities in the Commerce module allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into various fields, including
Shipping Name, Shipping Phone Number, Shipping Address, Billing Name, Billing Phone Number, Billing Address, and others.Recommendations
For Liferay Portal versions 7.3.5 through 7.4.3.91, update to a version later than 7.4.3.91.
For Liferay DXP versions 7.3 update 33 and earlier, update to a version later than update 33.
For Liferay DXP version 7.4 before update 92, update to update 92 or later.
As a temporary workaround, consider restricting access to the Commerce module until a patch is available.
Avoid using the vulnerable fields in the Commerce module until the issue is resolved.
Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Liferay Dxp
Liferay Portal