Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1tdmZ2LXczZnEteHA2N84AAzdA

Cross-site scripting in Liferay Portal

Multiple cross-site scripting (XSS) vulnerabilities in the Plugin for OAuth 2.0 module's OAuth2ProviderApplicationRedirect class in Liferay Portal 7.4.3.41 through 7.4.3.52, and Liferay DXP 7.4 update 41 through 52 allow remote attackers to inject arbitrary web script or HTML via the (1) code, or (2) error parameter.

Permalink: https://github.com/advisories/GHSA-mvfv-w3fq-xp67
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1tdmZ2LXczZnEteHA2N84AAzdA
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: 11 months ago
Updated: 5 months ago

CVSS Score: 6.1
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Identifiers: GHSA-mvfv-w3fq-xp67, CVE-2023-33941
References:

• https://nvd.nist.gov/vuln/detail/CVE-2023-33941
• https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33941
• https://github.com/advisories/GHSA-mvfv-w3fq-xp67

Blast Radius: 9.3

Affected Packages