Description
Cross-site scripting (XSS) vulnerability in IFrame type Remote Apps in Liferay Portal 7.4.0 through 7.4.3.30, and Liferay DXP 7.4 before update 31 allows remote attackers to inject arbitrary web script or HTML via the Remote App's IFrame URL.
Remediation
References
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33940
Related Vulnerabilities
CVE-2023-39154 Vulnerability in maven package com.qualys.plugins:qualys-was
CVE-2022-40664 Vulnerability in maven package org.apache.shiro:shiro-core
CVE-2020-1940 Vulnerability in maven package org.apache.jackrabbit:oak-core
CVE-2020-13951 Vulnerability in maven package org.apache.openmeetings:openmeetings-server
CVE-2023-46131 Vulnerability in maven package org.grails:grails-encoder