CVE-2023-33941

2023-05-2415:15:09

CWE-79

Liferay

web.nvd.nist.gov

xss

vulnerability

oauth 2.0

liferay portal

nvd

cve-2023-33941

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

29.6%

JSON

Multiple cross-site scripting (XSS) vulnerabilities in the Plugin for OAuth 2.0 module’s OAuth2ProviderApplicationRedirect class in Liferay Portal 7.4.3.41 through 7.4.3.52, and Liferay DXP 7.4 update 41 through 52 allow remote attackers to inject arbitrary web script or HTML via the (1) code, or (2) error parameter.

Affected configurations

Nvd

Node

liferaydigital_experience_platformMatch7.4update41

liferaydigital_experience_platformMatch7.4update52

liferayliferay_portalRange7.4.3.31–7.4.3.52

VendorProductVersionCPE
liferaydigital_experience_platform7.4cpe:2.3:a:liferay:digital_experience_platform:7.4:update41:*:*:*:*:*:*
liferaydigital_experience_platform7.4cpe:2.3:a:liferay:digital_experience_platform:7.4:update52:*:*:*:*:*:*
liferayliferay_portal*cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
liferay	digital_experience_platform	7.4	cpe:2.3:a:liferay:digital_experience_platform:7.4:update41::::::
liferay	digital_experience_platform	7.4	cpe:2.3:a:liferay:digital_experience_platform:7.4:update52::::::
liferay	liferay_portal	*	cpe:2.3:a:liferay:liferay_portal::::::::

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Portal",
    "vendor": "Liferay",
    "versions": [
      {
        "lessThanOrEqual": "7.4.3.52",
        "status": "affected",
        "version": "7.4.3.41",
        "versionType": "maven"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "DXP",
    "vendor": "Liferay",
    "versions": [
      {
        "lessThanOrEqual": "7.4.13.u52",
        "status": "affected",
        "version": "7.4.13.u41",
        "versionType": "maven"
      }
    ]
  }
]