Paper/Archive/CVE-2023-42629

CVE-2023-42629

Liferay DXP — Stored cross-site scripting (XSS) vulnerability in the manage vocabulary page in Liferay Portal 7.4.2 through 7.4.3.87, and Liferay DXP 7…

EPSS 3%CVSS 9.0

critical.is priorityof 100

CVSS 9.0 (CNA)9.0 / 10 × 3027.0 Not in CISA KEV+300.0 EPSS percentile 86.4.864 × 2017.3 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

Stored cross-site scripting (XSS) vulnerability in the manage vocabulary page in Liferay Portal 7.4.2 through 7.4.3.87, and Liferay DXP 7.4 before update 88 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a Vocabulary's 'description' text field.

Affected

ProductAffectedFixed inSource

DXP7.4.13 – 7.4.13.u87–CNA

Portal7.4.2 – 7.4.3.87–CNA

Scores by source

Liferay (CNA)9.0CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

References

advisoryliferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-42629 exploitpentagrid.ch/en/blog/stored-cross-site-scripting-vulnerabilities-in-liferay-portal