Skip to content
CVE PROGRAM SOURCE RECORD5.4 Medium

CVE-2023-33937

Stored cross-site scripting (XSS) vulnerability in Form widget configuration in Liferay Portal 7.1.0 through 7.3.0, and Liferay DXP 7.1 before fix pack 18, and 7.2 before fix pack

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Liferay

Description

Stored cross-site scripting (XSS) vulnerability in Form widget configuration in Liferay Portal 7.1.0 through 7.3.0, and Liferay DXP 7.1 before fix pack 18, and 7.2 before fix pack 5 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a form's `name` field.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Liferay Portal

Default version status: unaffected

  • 7.1.0 to ≤ 7.3.0affected

Liferay DXP

Default version status: unaffected

  • 7.1.10 to ≤ 7.1.10-dxp-17affected
  • 7.2.10 to ≤ 7.2.10-dxp-4affected

References