CVE-2023-42497 — Liferay / DXP

Description (CNA)

Reflected cross-site scripting (XSS) vulnerability on the Export for Translation page in Liferay Portal 7.4.3.4 through 7.4.3.85, and Liferay DXP 7.4 before update 86 allows remote attackers to inject arbitrary web script or HTML via the `_com_liferay_translation_web_internal_portlet_TranslationPortlet_redirect` parameter.

Affected (CNA)

Vendor / product	Versions
Liferay / DXP	affected 7.4.13 through 7.4.13.u85
Liferay / Portal	affected 7.4.3.4 through 7.4.3.85

CWE

CWE-79

References

https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-42497

ADP enrichment

CVE

No English description supplied.

https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-42497

CISA-ADP

No English description supplied.

No references supplied.