CVE-2023-42498

CRITICAL

Liferay Portal 7.4.3.8-7.4.3.97 & DXP 2023.Q3 < patch 5 - Reflected XSS via Language Override

Title source: llm

Description

Reflected cross-site scripting (XSS) vulnerability in the Language Override edit screen in Liferay Portal 7.4.3.8 through 7.4.3.97, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 4 through 92 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_portal_language_override_web_internal_portlet_PLOPortlet_key parameter.

References (1)

Core 1

Core References

Vendor Advisory vendor-advisory

https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-42498

Scores

CVSS v3 9.6

EPSS 0.0044

EPSS Percentile 63.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-79

Status published

Products (3)

com.liferay.portal/release.dxp.bom 2023.Q3 - 2023.Q3.5Maven

com.liferay.portal/release.portal.bom 7.4.3.8 - 7.4.3.98Maven

liferay/digital_experience_platform 7.4 update10 (48 CPE variants)

Published Feb 21, 2024

Tracked Since Feb 18, 2026