BIT-2023-42497

2023-10-2418:19:58

Google

osv.dev

reflected xss

liferay portal

remote attackers

injection

web script

html

parameter

0.001 Low

EPSS

Percentile

25.2%

JSON

Reflected cross-site scripting (XSS) vulnerability on the Export for Translation page in Liferay Portal 7.4.3.4 through 7.4.3.85, and Liferay DXP 7.4 before update 86 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_translation_web_internal_portlet_TranslationPortlet_redirect parameter.

CPENameOperatorVersion
liferayge7.4.0
liferayle7.4.0
liferayge7.4-update1.0
liferayle7.4-update1.0
liferayge7.4-update21.0
liferayle7.4-update21.0
liferayge7.4-update34.0
liferayle7.4-update34.0
liferayge7.4-update36.0
liferayle7.4-update36.0

Name	Operator	Version
liferay	ge	7.4.0
liferay	le	7.4.0
liferay	ge	7.4-update1.0
liferay	le	7.4-update1.0
liferay	ge	7.4-update21.0
liferay	le	7.4-update21.0
liferay	ge	7.4-update34.0
liferay	le	7.4-update34.0
liferay	ge	7.4-update36.0
liferay	le	7.4-update36.0