Description

Cross-site scripting (XSS) vulnerability in IFrame type Remote Apps in Liferay Portal 7.4.0 through 7.4.3.30, and Liferay DXP 7.4 before update 31 allows remote attackers to inject arbitrary web script or HTML via the Remote App's IFrame URL.

Remediation

References

https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33940

Related Vulnerabilities

CVE-2012-0394 Vulnerability in maven package org.apache.struts:struts2-core

CVE-2020-5219 Vulnerability in maven package org.webjars.npm:angular-expressions

CVE-2016-0790 Vulnerability in maven package org.jenkins-ci.main:jenkins-core

CVE-2022-25167 Vulnerability in maven package org.apache.flume:flume-parent

CVE-2022-36944 Vulnerability in maven package org.scala-lang:scala-library

Severity

Medium

Classification

CWE-79 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Tags

Vendor Advisory