Skip to content
OpenAdvisories
High WID-SEC-2023-2670 5 CVEs

Liferay Liferay Portal: Mehrere Schwachstellen ermöglichen Cross-Site Scripting

Published Oct 16, 2023 · Updated Oct 16, 2023 · de-DE

Vendor: Liferay Product: DXP Product: Liferay DXP < 7.3 update 24 Product: Liferay DXP < 7.4 update 54 Product: Liferay DXP < 7.4 update 79 Product: Liferay DXP < 7.4 update 86 Product: Liferay DXP < 7.4 update 88 Product: Liferay DXP < 7.4 update 90 Product: Liferay Portal < 7.4.3.54 Product: Liferay Portal < 7.4.3.79 Product: Liferay Portal < 7.4.3.86 Product: Liferay Portal < 7.4.3.88 Product: Liferay Portal < 7.4.3.90 Product: Portal Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Liferay Liferay Portal und Liferay Liferay DXP ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.

Product

Liferay Portal ist eine Open-Source-Webplattform für Unternehmen, die ein Framework für die Erstellung und Verwaltung von webbasierten Anwendungen und Inhalten bietet.
Liferay DXP (Digital Experience Platform) ist eine erweiterte und kommerziell unterstützte Version von Liferay Portal, die zusätzliche Funktionen und Dienste bietet.

Vulnerabilities 5

  • Critical 9.6
    CVE-2023-42497

    Liferay Portal and Liferay DXP Vulnerable to Reflected XSS via the Export for Translation Page

    Reflected cross-site scripting (XSS) vulnerability on the Export for Translation page in Liferay Portal 7.4.3.4 through 7.4.3.85, and Liferay DXP 7.4 before update 86 allows remote attackers to inject arbitrary web script or HTML via the `_com_liferay_transla…

    Liferay DXP Portal com.liferay.portal:release.dxp.bom Maven
  • Critical 9.6
    CVE-2023-44311

    Liferay Portal and Liferay DXP Vulnerable to XSS via the OAuth2ProviderApplicationRedirect Class

    Multiple reflected cross-site scripting (XSS) vulnerabilities in the Plugin for OAuth 2.0 module's OAuth2ProviderApplicationRedirect class in Liferay Portal 7.4.3.41 through 7.4.3.89, and Liferay DXP 7.4 update 41 through update 89 allow remote attackers to i…

    Liferay DXP Portal com.liferay.portal:release.dxp.bom Maven
  • Critical 9.0
    CVE-2023-42629

    Liferay Portal and Liferay DXP Vulnerable to Stored XSS in the Manage Vocabulary Page

    Stored cross-site scripting (XSS) vulnerability in the manage vocabulary page in Liferay Portal 7.4.2 through 7.4.3.87, and Liferay DXP 7.4 before update 88 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a V…

    Liferay DXP Portal com.liferay.portal:release.dxp.bom Maven
  • Critical 9.0
    CVE-2023-44309

    Liferay Portal and Liferay DXP Vulnerable to XSS in the Fragment Components

    Multiple stored cross-site scripting (XSS) vulnerabilities in the fragment components in Liferay Portal 7.4.2 through 7.4.3.53, and Liferay DXP 7.4 before update 54 allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected i…

    Liferay DXP Portal com.liferay.portal:release.dxp.bom Maven
  • Critical 9.0
    CVE-2023-44310

    Liferay Portal and Liferay DXP Vulnerable to XSS via the Page Tree Menu

    Stored cross-site scripting (XSS) vulnerability in Page Tree menu Liferay Portal 7.3.6 through 7.4.3.78, and Liferay DXP 7.3 fix pack 1 through update 23, and 7.4 before update 79 allows remote attackers to inject arbitrary web script or HTML via a crafted pa…

    Liferay DXP Portal com.liferay.portal:release.dxp.bom Maven

Revision history

  1. #1

    Initiale Fassung

References