PT-2023-30614 · Liferay · Liferay Portal

Published 2023-11-17 · Updated 2023-11-23 · CVE-2023-47797

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.4.3.94 through 7.4.3.95

Description A reflected cross-site scripting issue exists, allowing remote attackers to inject arbitrary web script or HTML via the p l back url title parameter on a content page's edit page.

Recommendations For Liferay Portal versions 7.4.3.94 through 7.4.3.95, avoid using the p l back url title parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-47797

GHSA-V32M-PF9Q-P3XG

Affected Products

Liferay Portal

References · 6

• https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-47797 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-47797 · Security Note
• https://osv.dev/vulnerability/GHSA-v32m-pf9q-p3xg · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-47797 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-47797 · Note
• https://t.me/latest_high_impact_cve/97 · Telegram Post