Description
Reflected cross-site scripting (XSS) vulnerability in the Language Override edit screen in Liferay Portal 7.4.3.8 through 7.4.3.97, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 4 through 92 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_portal_language_override_web_internal_portlet_PLOPortlet_key parameter.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Liferay | Portal | 7.4.3.8 – ≤ 7.4.3.97 | — |
| Liferay | DXP | 2023.q3.1 – ≤ 2023.q3.4, 7.4.13.u4 – ≤ 7.4.13.u92 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | com.liferay.portal:release.dxp.bom | >= 2023.Q3, < 2023.Q3.5 | 2023.Q3.5 | GHSA-73x3-8mrg-5r93 |
| Maven | com.liferay.portal:release.dxp.bom | >= 7.4.13.u4, <= 7.4.13.u92 | — | GHSA-73x3-8mrg-5r93 |
| Maven | com.liferay.portal:release.portal.bom | >= 7.4.3.8, < 7.4.3.98 | 7.4.3.98 | GHSA-73x3-8mrg-5r93 |
Advisories 1
- WID-SEC-2024-0440 Liferay Portal und Liferay DXP: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 20, 2024