Description

Cross-site scripting (XSS) vulnerability in the Web Content Display widget's article selector in Liferay Liferay Portal 7.4.3.50, and Liferay DXP 7.4 update 50 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a web content article's `Title` field.

Remediation

References

CVE-2023-33942

Related Vulnerabilities

WordPress Plugin Cool Flickr Slideshow Cross-Site Scripting (1.0)

OpenVPN AS Divide By Zero Vulnerability (CVE-2023-46849)

Oracle HTTP Server Other Vulnerability (CVE-2006-5347)

WordPress Plugin Yoast SEO Cross-Site Scripting (22.6)

WordPress Plugin BackUpWordPress Unspecified Vulnerability (3.12)

Severity

Medium

Classification

CVE-2023-33942 CWE-707 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities