BIT-2023-42629

2023-10-2506:20:34

Google

osv.dev

stored cross-site scripting

manage vocabulary page

liferay portal 7.4.2

liferay portal 7.4.3.87

liferay dxp 7.4

0.001 Low

EPSS

Percentile

20.7%

JSON

Stored cross-site scripting (XSS) vulnerability in the manage vocabulary page in Liferay Portal 7.4.2 through 7.4.3.87, and Liferay DXP 7.4 before update 88 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a Vocabulary’s ‘description’ text field.

CPENameOperatorVersion
liferayge7.4.0
liferayle7.4.0
liferayge7.4-update1.0
liferayle7.4-update1.0
liferayge7.4-update21.0
liferayle7.4-update21.0
liferayge7.4-update34.0
liferayle7.4-update34.0
liferayge7.4-update36.0
liferayle7.4-update36.0

Name	Operator	Version
liferay	ge	7.4.0
liferay	le	7.4.0
liferay	ge	7.4-update1.0
liferay	le	7.4-update1.0
liferay	ge	7.4-update21.0
liferay	le	7.4-update21.0
liferay	ge	7.4-update34.0
liferay	le	7.4-update34.0
liferay	ge	7.4-update36.0
liferay	le	7.4-update36.0