GHSA-mvfv-w3fq-xp67

ghsaUSosv

Cross-site scripting in Liferay Portal

view advisory published 2023-05-24Licence: CC-BY-4.0

Multiple cross-site scripting (XSS) vulnerabilities in the Plugin for OAuth 2.0 module's OAuth2ProviderApplicationRedirect class in Liferay Portal 7.4.3.41 through 7.4.3.52, and Liferay DXP 7.4 update 41 through 52 allow remote attackers to inject arbitrary web script or HTML via the (1) code, or (2) error parameter.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2023-33941US	medium6.1	0.46% (40th)	—	2023-05-24
Multiple cross-site scripting (XSS) vulnerabilities in the Plugin for OAuth 2.0 module's OAuth2ProviderApplicationRedirect class in Liferay Portal 7.4.3.41 through 7.4.3.52, and Li…

references

External citations — patches, advisories, analysis.

https://github.com/liferay/liferay-portalPACKAGE
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33941WEB
https://nvd.nist.gov/vuln/detail/CVE-2023-33941ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan