CVE-2023-33940

Liferay / Portal PUBLISHED

Description (CNA)

Cross-site scripting (XSS) vulnerability in IFrame type Remote Apps in Liferay Portal 7.4.0 through 7.4.3.30, and Liferay DXP 7.4 before update 31 allows remote attackers to inject arbitrary web script or HTML via the Remote App's IFrame URL.

Affected (CNA)

Vendor / product	Versions
Liferay / Portal	affected 7.4.0 through 7.4.3.30
Liferay / DXP	affected 7.4.13 through 7.4.13.u30

CWE

CWE-79

References

https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33940

ADP enrichment

CVE

No English description supplied.

https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33940

CISA-ADP

No English description supplied.

No references supplied.