CVE-2023-33944 MEDIUM

CVE-2023-33944

Vendor Liferay
Product Portal
Weakness CWE-79 · XSS
Published May 24, 2023
Last update October 22, 2024
View on NVD All CVEs

CVSS base score

4.8/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

Cross-site scripting (XSS) vulnerability in Layout module in Liferay Portal 7.3.4 through 7.4.3.68, and Liferay DXP 7.3 before update 24, and 7.4 before update 69 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a container type layout fragment's `URL` text field.

Key dates

02Disclosure timeline

May 24, 2023 CVE published
October 22, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-44025 WordPress NiceJob plugin < 3.6.5 - Cross Site Scripting (XSS) vulnerability CVE-2024-9068 OneElements – Best Elementor Addons <= 1.3.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload CVE-2023-5291 Blog Filter <= 1.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVE-2024-11881 Easy Waveform Player <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2025-39446 WordPress Booster Plus for WooCommerce plugin <= 7.2.4 - Reflected Cross Site Scripting (XSS) vulnerability