Lucene search

[email protected]CVE-2023-42628

HistoryOct 17, 2023 - 12:15 p.m.

CVE-2023-42628

2023-10-1712:15:10

CWE-79

[email protected]

web.nvd.nist.gov

cve-2023-42628

stored xss

liferay portal

liferay dxp

remote attackers

web vulnerability

9 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

0.001 Low

EPSS

Percentile

20.4%

JSON

Stored cross-site scripting (XSS) vulnerability in the Wiki widget in Liferay Portal 7.1.0 through 7.4.3.87, and Liferay DXP 7.0 fix pack 83 through 102, 7.1 fix pack 28 and earlier, 7.2 fix pack 20 and earlier, 7.3 update 33 and earlier, and 7.4 before update 88 allows remote attackers to inject arbitrary web script or HTML into a parent wiki page via a crafted payload injected into a wiki page’s ‘Content’ text field.

Affected configurations

NVD

Node

liferaydigital_experience_platformMatch7.0-

liferaydigital_experience_platformMatch7.0fix_pack_1

liferaydigital_experience_platformMatch7.0fix_pack_10

liferaydigital_experience_platformMatch7.0fix_pack_11

liferaydigital_experience_platformMatch7.0fix_pack_12

liferaydigital_experience_platformMatch7.0fix_pack_13

liferaydigital_experience_platformMatch7.0fix_pack_14

liferaydigital_experience_platformMatch7.0fix_pack_15

liferaydigital_experience_platformMatch7.0fix_pack_16

liferaydigital_experience_platformMatch7.0fix_pack_17

liferaydigital_experience_platformMatch7.0fix_pack_18

liferaydigital_experience_platformMatch7.0fix_pack_19

liferaydigital_experience_platformMatch7.0fix_pack_2

liferaydigital_experience_platformMatch7.0fix_pack_20

liferaydigital_experience_platformMatch7.0fix_pack_21

liferaydigital_experience_platformMatch7.0fix_pack_22

liferaydigital_experience_platformMatch7.0fix_pack_23

liferaydigital_experience_platformMatch7.0fix_pack_24

liferaydigital_experience_platformMatch7.0fix_pack_25

liferaydigital_experience_platformMatch7.0fix_pack_26

liferaydigital_experience_platformMatch7.0fix_pack_27

liferaydigital_experience_platformMatch7.0fix_pack_28

liferaydigital_experience_platformMatch7.0fix_pack_29

liferaydigital_experience_platformMatch7.0fix_pack_3

liferaydigital_experience_platformMatch7.0fix_pack_30

liferaydigital_experience_platformMatch7.0fix_pack_31

liferaydigital_experience_platformMatch7.0fix_pack_32

liferaydigital_experience_platformMatch7.0fix_pack_33

liferaydigital_experience_platformMatch7.0fix_pack_34

liferaydigital_experience_platformMatch7.0fix_pack_35

liferaydigital_experience_platformMatch7.0fix_pack_36

liferaydigital_experience_platformMatch7.0fix_pack_37

liferaydigital_experience_platformMatch7.0fix_pack_38

liferaydigital_experience_platformMatch7.0fix_pack_39

liferaydigital_experience_platformMatch7.0fix_pack_4

liferaydigital_experience_platformMatch7.0fix_pack_40

liferaydigital_experience_platformMatch7.0fix_pack_41

liferaydigital_experience_platformMatch7.0fix_pack_42

liferaydigital_experience_platformMatch7.0fix_pack_43

liferaydigital_experience_platformMatch7.0fix_pack_44

liferaydigital_experience_platformMatch7.0fix_pack_45

liferaydigital_experience_platformMatch7.0fix_pack_46

liferaydigital_experience_platformMatch7.0fix_pack_47

liferaydigital_experience_platformMatch7.0fix_pack_48

liferaydigital_experience_platformMatch7.0fix_pack_49

liferaydigital_experience_platformMatch7.0fix_pack_5

liferaydigital_experience_platformMatch7.0fix_pack_50

liferaydigital_experience_platformMatch7.0fix_pack_51

liferaydigital_experience_platformMatch7.0fix_pack_52

liferaydigital_experience_platformMatch7.0fix_pack_53

liferaydigital_experience_platformMatch7.0fix_pack_54

liferaydigital_experience_platformMatch7.0fix_pack_55

liferaydigital_experience_platformMatch7.0fix_pack_56

liferaydigital_experience_platformMatch7.0fix_pack_57

liferaydigital_experience_platformMatch7.0fix_pack_58

liferaydigital_experience_platformMatch7.0fix_pack_59

liferaydigital_experience_platformMatch7.0fix_pack_6

liferaydigital_experience_platformMatch7.0fix_pack_60

liferaydigital_experience_platformMatch7.0fix_pack_61

liferaydigital_experience_platformMatch7.0fix_pack_62

liferaydigital_experience_platformMatch7.0fix_pack_63

liferaydigital_experience_platformMatch7.0fix_pack_64

liferaydigital_experience_platformMatch7.0fix_pack_65

liferaydigital_experience_platformMatch7.0fix_pack_66

liferaydigital_experience_platformMatch7.0fix_pack_67

liferaydigital_experience_platformMatch7.0fix_pack_68

liferaydigital_experience_platformMatch7.0fix_pack_69

liferaydigital_experience_platformMatch7.0fix_pack_7

liferaydigital_experience_platformMatch7.0fix_pack_70

liferaydigital_experience_platformMatch7.0fix_pack_71

liferaydigital_experience_platformMatch7.0fix_pack_72

liferaydigital_experience_platformMatch7.0fix_pack_73

liferaydigital_experience_platformMatch7.0fix_pack_74

liferaydigital_experience_platformMatch7.0fix_pack_75

liferaydigital_experience_platformMatch7.0fix_pack_76

liferaydigital_experience_platformMatch7.0fix_pack_77

liferaydigital_experience_platformMatch7.0fix_pack_78

liferaydigital_experience_platformMatch7.0fix_pack_79

liferaydigital_experience_platformMatch7.0fix_pack_8

liferaydigital_experience_platformMatch7.0fix_pack_80

liferaydigital_experience_platformMatch7.0fix_pack_81

liferaydigital_experience_platformMatch7.0fix_pack_82

liferaydigital_experience_platformMatch7.1-

liferaydigital_experience_platformMatch7.2-

liferaydigital_experience_platformMatch7.3-

liferaydigital_experience_platformMatch7.4-

liferaydigital_experience_platformMatch7.4update1

liferaydigital_experience_platformMatch7.4update21

liferaydigital_experience_platformMatch7.4update34

liferaydigital_experience_platformMatch7.4update36

liferaydigital_experience_platformMatch7.4update41

liferaydigital_experience_platformMatch7.4update48

liferaydigital_experience_platformMatch7.4update50

liferaydigital_experience_platformMatch7.4update52

liferaydigital_experience_platformMatch7.4update62

liferaydigital_experience_platformMatch7.4update67

liferaydigital_experience_platformMatch7.4update76

liferaydigital_experience_platformMatch7.4update81

liferaydigital_experience_platformMatch7.4update82

liferaydigital_experience_platformMatch7.4update83

liferaydigital_experience_platformMatch7.4update84

liferaydigital_experience_platformMatch7.4update85

liferaydigital_experience_platformMatch7.4update86

Node

liferayliferay_portalRange7.1.0–7.4.3.88

CPENameOperatorVersion
liferay:digital_experience_platformliferay digital experience platformeq7.0
liferay:digital_experience_platformliferay digital experience platformeq7.1
liferay:digital_experience_platformliferay digital experience platformeq7.2
liferay:digital_experience_platformliferay digital experience platformeq7.3
liferay:digital_experience_platformliferay digital experience platformeq7.4

CPE	Name	Operator	Version
liferay:digital_experience_platform	liferay digital experience platform	eq	7.0
liferay:digital_experience_platform	liferay digital experience platform	eq	7.1
liferay:digital_experience_platform	liferay digital experience platform	eq	7.2
liferay:digital_experience_platform	liferay digital experience platform	eq	7.3
liferay:digital_experience_platform	liferay digital experience platform	eq	7.4

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "DXP",
    "vendor": "Liferay",
    "versions": [
      {
        "lessThanOrEqual": "7.0.10-*",
        "status": "affected",
        "version": "7.0.10-de-83",
        "versionType": "maven"
      },
      {
        "lessThanOrEqual": "7.1.10-*",
        "status": "affected",
        "version": "7.1.10",
        "versionType": "maven"
      },
      {
        "lessThanOrEqual": "7.2.10-*",
        "status": "affected",
        "version": "7.2.10",
        "versionType": "maven"
      },
      {
        "lessThanOrEqual": "7.3.10-*",
        "status": "affected",
        "version": "7.3.10",
        "versionType": "maven"
      },
      {
        "lessThanOrEqual": "7.4.13.u87",
        "status": "affected",
        "version": "7.4.13",
        "versionType": "maven"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Portal",
    "vendor": "Liferay",
    "versions": [
      {
        "lessThanOrEqual": "7.4.3.87",
        "status": "affected",
        "version": "7.1.0",
        "versionType": "maven"
      }
    ]
  }
]