Cross-site scripting in Liferay Portal
Date: 2023-05
Affected: maven/com.liferay.portal:release.portal.bom
Attack vector: xss
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2023-33937
CVE-2023-33938
CVE-2023-33939
CVE-2023-33940
CVE-2023-33941
CVE-2023-33942
CVE-2023-33943
CVE-2023-33944
CWE: CWE-79
CVSS: 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

Cross-site scripting (XSS) vulnerability in Layout module in Liferay Portal 7.3.4 through 7.4.3.68, and Liferay DXP 7.3 before update 24, and 7.4 before update 69 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a container type layout fragment's `URL` text field.


Mitigations:

Architectural layers (MAESTRO):