CVE-2023-3193

Cross-site scripting (XSS) vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.73, and Liferay DXP 7.4 update 70 through 73 allows remote attackers to inject arbitrary web script or HTML via the `_com_liferay_layout_admin_web_portlet_GroupPagesPortlet_backURL` parameter.
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:liferay:dxp:7.4:update_70:*:*:*:*:*:*
cpe:2.3:a:liferay:dxp:7.4:update_71:*:*:*:*:*:*
cpe:2.3:a:liferay:dxp:7.4:update_72:*:*:*:*:*:*
cpe:2.3:a:liferay:dxp:7.4:update_73:*:*:*:*:*:*
cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*

History

22 Jun 2023, 16:51

Type Values Removed Values Added
CWE CWE-79
CPE cpe:2.3:a:liferay:dxp:7.4:update_73:*:*:*:*:*:*
cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*
cpe:2.3:a:liferay:dxp:7.4:update_72:*:*:*:*:*:*
cpe:2.3:a:liferay:dxp:7.4:update_71:*:*:*:*:*:*
cpe:2.3:a:liferay:dxp:7.4:update_70:*:*:*:*:*:*
References (MISC) https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-3193 - (MISC) https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-3193 - Patch, Vendor Advisory
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 6.1
First Time Liferay
Liferay liferay Portal
Liferay dxp

15 Jun 2023, 04:15

Type Values Removed Values Added
New CVE

Information

Published : 2023-06-15 04:15

Updated : 2024-02-28 20:13


NVD link : CVE-2023-3193

Mitre link : CVE-2023-3193

CVE.ORG link : CVE-2023-3193


JSON object : View

Products Affected

liferay

  • dxp
  • liferay_portal
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')