Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.1

Liferay Portal and DXP: Malicious Code Injections Through Custom Object Fields

CVE-2023-33938 · published 3 years ago
Summary

An attacker can inject malicious code into Liferay Portal and DXP, affecting custom object fields, which can lead to unauthorized actions. This affects Liferay Portal 7.3.0-7.4.0 and Liferay DXP 7.3 before update 14. To fix this, apply the latest updates for Liferay DXP 7.3 and update custom objects to ensure secure data entry.

What to do
  • Update liferay com.liferay.portal:release.portal.bom to version 7.4.1.
Affected software
Ecosystem VendorProductAffected versions
maven liferay com.liferay.portal:release.portal.bom >= 7.3.0, < 7.4.1
Fix: upgrade to 7.4.1
– liferay digital_experience_platform 7.3
cpe:2.3:a:liferay:digital_experience_platform:7.3:-:*:*:*:*:*:*
– liferay liferay_portal >= 7.3.0, <= 7.3.7
7.4.0
cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*
Original advisory text
Cross-site scripting (XSS) vulnerability in the App Builder module's custom object details page in Liferay Portal 7.3.0 through 7.4.0, and Liferay DXP 7.3 before update 14 allows remote attackers t...
Cross-site scripting (XSS) vulnerability in the App Builder module's custom object details page in Liferay Portal 7.3.0 through 7.4.0, and Liferay DXP 7.3 before update 14 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into an App Builder custom object's `Name` field.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
6.1 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published24 May 2023
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-wvhw-5m89-64gv · GHSA
CVE-2023-33938 · NVD
Track software like this
Free during beta