Description

Cross-site scripting (XSS) vulnerability in the Web Content Display widget's article selector in Liferay Liferay Portal 7.4.3.50, and Liferay DXP 7.4 update 50 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a web content article's `Title` field.

Remediation

References

CVE-2023-33942

Related Vulnerabilities

WordPress Plugin Easy Custom Sidebars Unspecified Vulnerability (1.0.1)

Magento Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2019-8152)

PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2016-6291)

Drupal Core 4.7.x Multiple Vulnerabilities (4.7.0 - 4.7.1)

WebLogic CVE-2022-21453 Vulnerability (CVE-2022-21453)

Severity

Medium

Classification

CVE-2023-33942 CWE-707 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities