CVE-2023-3193
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
A cross-site scripting (XSS) vulnerability exists in the SEO configuration of the Layout module in Liferay Portal versions 7.4.3.70 to 7.4.3.73 and Liferay DXP 7.4 update 70 to 73. It allows remote attackers to inject arbitrary web scripts or HTML via the `_com_liferay_layout_admin_web_portlet_GroupPagesPortlet_backURL` parameter.
Risk Assessment
This vulnerability could lead to user data theft, session hijacking, and other attacks that may compromise the security of the application and the organization's data.
Recommendation
It is recommended to update Liferay Portal and Liferay DXP to the latest versions that address this vulnerability. Additionally, conducting a security audit of the application to identify and remediate potential vulnerabilities is advisable.
Original NVD description (English source)
Cross-site scripting (XSS) vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.73, and Liferay DXP 7.4 update 70 through 73 allows remote attackers to inject arbitrary web script or HTML via the `_com_liferay_layout_admin_web_portlet_GroupPagesPortlet_backURL` parameter.