Lucene search

LiferayCVE-2023-44310

HistoryOct 17, 2023 - 10:15 a.m.

CVE-2023-44310

2023-10-1710:15:09

CWE-79

Liferay

web.nvd.nist.gov

cve

2023

44310

stored xss

liferay portal

page tree menu

nvd

vulnerability

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

EPSS

0.001

Percentile

21.3%

JSON

Stored cross-site scripting (XSS) vulnerability in Page Tree menu Liferay Portal 7.3.6 through 7.4.3.78, and Liferay DXP 7.3 fix pack 1 through update 23, and 7.4 before update 79 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into page’s “Name” text field.

Affected configurations

Nvd

Node

liferaydigital_experience_platformMatch7.1fix_pack_1

liferaydigital_experience_platformMatch7.1fix_pack_10

liferaydigital_experience_platformMatch7.1fix_pack_11

liferaydigital_experience_platformMatch7.1fix_pack_12

liferaydigital_experience_platformMatch7.1fix_pack_13

liferaydigital_experience_platformMatch7.1fix_pack_14

liferaydigital_experience_platformMatch7.1fix_pack_15

liferaydigital_experience_platformMatch7.1fix_pack_16

liferaydigital_experience_platformMatch7.1fix_pack_17

liferaydigital_experience_platformMatch7.1fix_pack_18

liferaydigital_experience_platformMatch7.1fix_pack_19

liferaydigital_experience_platformMatch7.1fix_pack_2

liferaydigital_experience_platformMatch7.1fix_pack_20

liferaydigital_experience_platformMatch7.1fix_pack_21

liferaydigital_experience_platformMatch7.1fix_pack_22

liferaydigital_experience_platformMatch7.1fix_pack_23

liferaydigital_experience_platformMatch7.1fix_pack_3

liferaydigital_experience_platformMatch7.1fix_pack_4

liferaydigital_experience_platformMatch7.1fix_pack_5

liferaydigital_experience_platformMatch7.1fix_pack_6

liferaydigital_experience_platformMatch7.1fix_pack_7

liferaydigital_experience_platformMatch7.1fix_pack_8

liferaydigital_experience_platformMatch7.1fix_pack_9

liferaydigital_experience_platformMatch7.4-

liferaydigital_experience_platformMatch7.4update1

liferaydigital_experience_platformMatch7.4update21

liferaydigital_experience_platformMatch7.4update34

liferaydigital_experience_platformMatch7.4update36

liferaydigital_experience_platformMatch7.4update41

liferaydigital_experience_platformMatch7.4update48

liferaydigital_experience_platformMatch7.4update50

liferaydigital_experience_platformMatch7.4update52

liferaydigital_experience_platformMatch7.4update62

liferaydigital_experience_platformMatch7.4update67

liferaydigital_experience_platformMatch7.4update76

liferayliferay_portalRange7.3.6–7.4.3.49

VendorProductVersionCPE
liferaydigital_experience_platform7.1cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_1:*:*:*:*:*:*
liferaydigital_experience_platform7.1cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_10:*:*:*:*:*:*
liferaydigital_experience_platform7.1cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_11:*:*:*:*:*:*
liferaydigital_experience_platform7.1cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_12:*:*:*:*:*:*
liferaydigital_experience_platform7.1cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_13:*:*:*:*:*:*
liferaydigital_experience_platform7.1cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_14:*:*:*:*:*:*
liferaydigital_experience_platform7.1cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_15:*:*:*:*:*:*
liferaydigital_experience_platform7.1cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_16:*:*:*:*:*:*
liferaydigital_experience_platform7.1cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_17:*:*:*:*:*:*
liferaydigital_experience_platform7.1cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_18:*:*:*:*:*:*

Vendor	Product	Version	CPE
liferay	digital_experience_platform	7.1	cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_1::::::
liferay	digital_experience_platform	7.1	cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_10::::::
liferay	digital_experience_platform	7.1	cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_11::::::
liferay	digital_experience_platform	7.1	cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_12::::::
liferay	digital_experience_platform	7.1	cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_13::::::
liferay	digital_experience_platform	7.1	cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_14::::::
liferay	digital_experience_platform	7.1	cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_15::::::
liferay	digital_experience_platform	7.1	cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_16::::::
liferay	digital_experience_platform	7.1	cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_17::::::
liferay	digital_experience_platform	7.1	cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_18::::::

Rows per page:

1-10 of 361

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "DXP",
    "vendor": "Liferay",
    "versions": [
      {
        "lessThanOrEqual": "7.3.10.u23",
        "status": "affected",
        "version": "7.3.10.sp1",
        "versionType": "maven"
      },
      {
        "lessThanOrEqual": "7.4.13.u78",
        "status": "affected",
        "version": "7.4.13",
        "versionType": "maven"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Portal",
    "vendor": "Liferay",
    "versions": [
      {
        "lessThanOrEqual": "7.4.3.78",
        "status": "affected",
        "version": "7.3.6",
        "versionType": "maven"
      }
    ]
  }
]