PT-2023-29205 · Liferay · Plugin For Oauth 2.0+2
Published
2023-10-17
·
Updated
2024-01-31
·
CVE-2023-44311
CVSS v3.1
9.6
Critical
| Vector | AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Liferay Portal versions 7.4.3.41 through 7.4.3.89
Liferay DXP 7.4 update 41 through update 89
Description
Multiple reflected cross-site scripting (XSS) vulnerabilities exist in the Plugin for OAuth 2.0 module's OAuth2ProviderApplicationRedirect class. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the
code or error parameters. This issue is caused by an incomplete fix.Recommendations
For Liferay Portal versions 7.4.3.41 through 7.4.3.89, consider disabling the OAuth2ProviderApplicationRedirect class until a patch is available.
For Liferay DXP 7.4 update 41 through update 89, restrict access to the Plugin for OAuth 2.0 module to minimize the risk of exploitation.
Avoid using the
code and error parameters in the affected API endpoints until the issue is resolved.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Liferay Dxp
Liferay Portal
Plugin For Oauth 2.0