CVE-2023-42629

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-42629
Stored cross-site scripting (XSS) vulnerability in the manage vocabulary page in Liferay Portal 7.4.2 through 7.4.3.87, and Liferay DXP 7.4 before update 88 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a Vocabulary's 'description' text field.

9.0 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 2.3 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-42629 Vendor Advisory
https://www.pentagrid.ch/en/blog/stored-cross-site-scripting-vulnerabilities-in-liferay-portal/ Exploit Third Party Advisory
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-42629 Vendor Advisory
https://www.pentagrid.ch/en/blog/stored-cross-site-scripting-vulnerabilities-in-liferay-portal/ Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:liferay:digital_experience_platform:7.4:-:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update1:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update21:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update34:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update36:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update41:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update48:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update50:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update52:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update62:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update67:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update76:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update81:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update82:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update83:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update84:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update85:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update86:*:*:*:*:*:*
cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*
History

21 Nov 2024, 08:22

Type Values Removed Values Added
References () https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-42629 - Vendor Advisory () https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-42629 - Vendor Advisory
References () https://www.pentagrid.ch/en/blog/stored-cross-site-scripting-vulnerabilities-in-liferay-portal/ - Exploit, Third Party Advisory () https://www.pentagrid.ch/en/blog/stored-cross-site-scripting-vulnerabilities-in-liferay-portal/ - Exploit, Third Party Advisory
CVSS v2 : unknown
v3 : 5.4 		v2 : unknown
v3 : 9.0

28 Dec 2023, 16:13

Type Values Removed Values Added
References () https://www.pentagrid.ch/en/blog/stored-cross-site-scripting-vulnerabilities-in-liferay-portal/ - () https://www.pentagrid.ch/en/blog/stored-cross-site-scripting-vulnerabilities-in-liferay-portal/ - Exploit, Third Party Advisory
Information

Published : 2023-10-17 09:15

Updated : 2024-11-21 08:22

NVD link : CVE-2023-42629

Mitre link : CVE-2023-42629

CVE.ORG link : CVE-2023-42629

JSON object : View

Products Affected

liferay

  • liferay_portal
  • digital_experience_platform
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')