CVE-2023-42496

Published: Feb 21, 2024Modified: Jan 28, 2025

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

Reflected cross-site scripting (XSS) vulnerability on the add assignees to a role page in Liferay Portal 7.3.3 through 7.4.3.97, and Liferay DXP 2023.Q3 before patch 6, 7.4 GA through update 92, and 7.3 before update 34 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_roles_admin_web_portlet_RolesAdminPortlet_tabs2 parameter.

Affected (129)

Products: Liferay: Liferay Portal, Digital Experience Platform

Liferay

2 products

Liferay Portal

Digital Experience Platform

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Liferay Liferay Portal	From 7.3.3 to 7.4.3.98

Configuration B

128 vulnerable

Vulnerable Software	Affected Versions
Liferay Digital Experience Platform	Version 7.3
Liferay Digital Experience Platform	Version 7.3 fix_pack_1
Liferay Digital Experience Platform	Version 7.3 fix_pack_2
Liferay Digital Experience Platform	Version 7.3 service_pack_1
Liferay Digital Experience Platform	Version 7.3 service_pack_3
Liferay Digital Experience Platform	Version 7.3 update10
Liferay Digital Experience Platform	Version 7.3 update11
Liferay Digital Experience Platform	Version 7.3 update12
Liferay Digital Experience Platform	Version 7.3 update13
Liferay Digital Experience Platform	Version 7.3 update14
Liferay Digital Experience Platform	Version 7.3 update15
Liferay Digital Experience Platform	Version 7.3 update16
Liferay Digital Experience Platform	Version 7.3 update17
Liferay Digital Experience Platform	Version 7.3 update18
Liferay Digital Experience Platform	Version 7.3 update19
Liferay Digital Experience Platform	Version 7.3 update20
Liferay Digital Experience Platform	Version 7.3 update21
Liferay Digital Experience Platform	Version 7.3 update22
Liferay Digital Experience Platform	Version 7.3 update23
Liferay Digital Experience Platform	Version 7.3 update24
Liferay Digital Experience Platform	Version 7.3 update25
Liferay Digital Experience Platform	Version 7.3 update26
Liferay Digital Experience Platform	Version 7.3 update27
Liferay Digital Experience Platform	Version 7.3 update28
Liferay Digital Experience Platform	Version 7.3 update29
Liferay Digital Experience Platform	Version 7.3 update30
Liferay Digital Experience Platform	Version 7.3 update31
Liferay Digital Experience Platform	Version 7.3 update32
Liferay Digital Experience Platform	Version 7.3 update33
Liferay Digital Experience Platform	Version 7.3 update4
Liferay Digital Experience Platform	Version 7.3 update5
Liferay Digital Experience Platform	Version 7.3 update6
Liferay Digital Experience Platform	Version 7.3 update7
Liferay Digital Experience Platform	Version 7.3 update8
Liferay Digital Experience Platform	Version 7.3 update9
Liferay Digital Experience Platform	Version 7.4
Liferay Digital Experience Platform	Version 7.4 update10
Liferay Digital Experience Platform	Version 7.4 update11
Liferay Digital Experience Platform	Version 7.4 update12
Liferay Digital Experience Platform	Version 7.4 update13
Liferay Digital Experience Platform	Version 7.4 update14
Liferay Digital Experience Platform	Version 7.4 update15
Liferay Digital Experience Platform	Version 7.4 update16
Liferay Digital Experience Platform	Version 7.4 update17
Liferay Digital Experience Platform	Version 7.4 update18
Liferay Digital Experience Platform	Version 7.4 update19
Liferay Digital Experience Platform	Version 7.4 update1
Liferay Digital Experience Platform	Version 7.4 update20
Liferay Digital Experience Platform	Version 7.4 update21
Liferay Digital Experience Platform	Version 7.4 update22
Liferay Digital Experience Platform	Version 7.4 update23
Liferay Digital Experience Platform	Version 7.4 update24
Liferay Digital Experience Platform	Version 7.4 update25
Liferay Digital Experience Platform	Version 7.4 update26
Liferay Digital Experience Platform	Version 7.4 update27
Liferay Digital Experience Platform	Version 7.4 update28
Liferay Digital Experience Platform	Version 7.4 update29
Liferay Digital Experience Platform	Version 7.4 update2
Liferay Digital Experience Platform	Version 7.4 update30
Liferay Digital Experience Platform	Version 7.4 update31
Liferay Digital Experience Platform	Version 7.4 update32
Liferay Digital Experience Platform	Version 7.4 update33
Liferay Digital Experience Platform	Version 7.4 update34
Liferay Digital Experience Platform	Version 7.4 update35
Liferay Digital Experience Platform	Version 7.4 update36
Liferay Digital Experience Platform	Version 7.4 update37
Liferay Digital Experience Platform	Version 7.4 update38
Liferay Digital Experience Platform	Version 7.4 update39
Liferay Digital Experience Platform	Version 7.4 update3
Liferay Digital Experience Platform	Version 7.4 update40
Liferay Digital Experience Platform	Version 7.4 update41
Liferay Digital Experience Platform	Version 7.4 update42
Liferay Digital Experience Platform	Version 7.4 update43
Liferay Digital Experience Platform	Version 7.4 update44
Liferay Digital Experience Platform	Version 7.4 update45
Liferay Digital Experience Platform	Version 7.4 update46
Liferay Digital Experience Platform	Version 7.4 update47
Liferay Digital Experience Platform	Version 7.4 update48
Liferay Digital Experience Platform	Version 7.4 update49
Liferay Digital Experience Platform	Version 7.4 update4
Liferay Digital Experience Platform	Version 7.4 update50
Liferay Digital Experience Platform	Version 7.4 update51
Liferay Digital Experience Platform	Version 7.4 update52
Liferay Digital Experience Platform	Version 7.4 update53
Liferay Digital Experience Platform	Version 7.4 update54
Liferay Digital Experience Platform	Version 7.4 update55
Liferay Digital Experience Platform	Version 7.4 update56
Liferay Digital Experience Platform	Version 7.4 update57
Liferay Digital Experience Platform	Version 7.4 update58
Liferay Digital Experience Platform	Version 7.4 update59
Liferay Digital Experience Platform	Version 7.4 update5
Liferay Digital Experience Platform	Version 7.4 update60
Liferay Digital Experience Platform	Version 7.4 update61
Liferay Digital Experience Platform	Version 7.4 update62
Liferay Digital Experience Platform	Version 7.4 update63
Liferay Digital Experience Platform	Version 7.4 update64
Liferay Digital Experience Platform	Version 7.4 update65
Liferay Digital Experience Platform	Version 7.4 update66
Liferay Digital Experience Platform	Version 7.4 update67
Liferay Digital Experience Platform	Version 7.4 update68
Liferay Digital Experience Platform	Version 7.4 update69
Liferay Digital Experience Platform	Version 7.4 update6
Liferay Digital Experience Platform	Version 7.4 update70
Liferay Digital Experience Platform	Version 7.4 update71
Liferay Digital Experience Platform	Version 7.4 update72
Liferay Digital Experience Platform	Version 7.4 update73
Liferay Digital Experience Platform	Version 7.4 update74
Liferay Digital Experience Platform	Version 7.4 update75
Liferay Digital Experience Platform	Version 7.4 update76
Liferay Digital Experience Platform	Version 7.4 update77
Liferay Digital Experience Platform	Version 7.4 update78
Liferay Digital Experience Platform	Version 7.4 update79
Liferay Digital Experience Platform	Version 7.4 update7
Liferay Digital Experience Platform	Version 7.4 update80
Liferay Digital Experience Platform	Version 7.4 update81
Liferay Digital Experience Platform	Version 7.4 update82
Liferay Digital Experience Platform	Version 7.4 update83
Liferay Digital Experience Platform	Version 7.4 update84
Liferay Digital Experience Platform	Version 7.4 update85
Liferay Digital Experience Platform	Version 7.4 update86
Liferay Digital Experience Platform	Version 7.4 update87
Liferay Digital Experience Platform	Version 7.4 update88
Liferay Digital Experience Platform	Version 7.4 update89
Liferay Digital Experience Platform	Version 7.4 update8
Liferay Digital Experience Platform	Version 7.4 update90
Liferay Digital Experience Platform	Version 7.4 update91
Liferay Digital Experience Platform	Version 7.4 update92
Liferay Digital Experience Platform	Version 7.4 update9

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (2)

https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-42496

Source: security@liferay.com

Vendor Advisory

https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-42496

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.