WID-SEC-W-2023-2699

DeutschShown in its original language — a full translation is planned for a future version.

Liferay Liferay DXP: Mehrere Schwachstellen ermöglichen Cross-Site Scripting

view advisory published 2023-10-17

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Liferay Liferay DXP und Liferay Liferay Portal ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.

describes (2)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2023-42627US	medium5.4	2.79% (86th)	—	2023-10-17
Multiple stored cross-site scripting (XSS) vulnerabilities in the Commerce module in Liferay Portal 7.3.5 through 7.4.3.91, and Liferay DXP 7.3 update 33 and earlier, and 7.4 befor…
CVE-2023-42628US	medium5.4	2.78% (86th)	—	2023-10-17
Stored cross-site scripting (XSS) vulnerability in the Wiki widget in Liferay Portal 7.1.0 through 7.4.3.87, and Liferay DXP 7.0 fix pack 83 through 102, 7.1 fix pack 28 and earlie…

references

External citations — patches, advisories, analysis.

Liferay Security Advisory vom 2023-10-17external
Liferay Security Advisory vom 2023-10-17external
WID-SEC-W-2023-2699 - CSAF Versionself
WID-SEC-2023-2699 - Portal Versionself

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan