Paper/Archive/CVE-2023-42628

CVE-2023-42628

Liferay DXP — Stored cross-site scripting (XSS) vulnerability in the Wiki widget in Liferay Portal 7.1.0 through 7.4.3.87, and Liferay DXP 7.0 fix pack…

EPSS 3%CVSS 9.0

critical.is priorityof 100

CVSS 9.0 (CNA)9.0 / 10 × 3027.0 Not in CISA KEV+300.0 EPSS percentile 86.4.864 × 2017.3 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

Stored cross-site scripting (XSS) vulnerability in the Wiki widget in Liferay Portal 7.1.0 through 7.4.3.87, and Liferay DXP 7.0 fix pack 83 through 102, 7.1 fix pack 28 and earlier, 7.2 fix pack 20 and earlier, 7.3 update 33 and earlier, and 7.4 before update 88 allows remote attackers to inject arbitrary web script or HTML into a parent wiki page via a crafted payload injected into a wiki page's ‘Content’ text field.

Affected

ProductAffectedFixed inSource

DXP7.0.10-de-83 – 7.0.10-*–CNA

DXP7.1.10 – 7.1.10-*–CNA

DXP7.2.10 – 7.2.10-*–CNA

DXP7.3.10 – 7.3.10-*–CNA

DXP7.4.13 – 7.4.13.u87–CNA

Portal7.1.0 – 7.4.3.87–CNA

Scores by source

Liferay (CNA)9.0CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

References

advisoryliferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-42628 exploitpentagrid.ch/en/blog/stored-cross-site-scripting-vulnerabilities-in-liferay-portal