CVE-2023-44309 — Liferay / DXP

Description (CNA)

Multiple stored cross-site scripting (XSS) vulnerabilities in the fragment components in Liferay Portal 7.4.2 through 7.4.3.53, and Liferay DXP 7.4 before update 54 allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into any non-HTML field of a linked source asset.

Affected (CNA)

Vendor / product	Versions
Liferay / DXP	affected 7.4.13 through 7.4.13.u53
Liferay / Portal	affected 7.4.2 through 7.4.3.53

CWE

CWE-79

References

https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-44309

ADP enrichment

CVE

No English description supplied.

https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-44309

CISA-ADP

No English description supplied.

No references supplied.