CVE-2023-33937
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
A stored cross-site scripting (XSS) vulnerability exists in Liferay Portal versions 7.1.0 through 7.3.0 and Liferay DXP 7.1 before fix pack 18 and 7.2 before fix pack 5. Attackers can inject arbitrary web scripts or HTML via a crafted payload in a form's `name` field.
Risk Assessment
This vulnerability may lead to malicious code injection, posing a risk of user data theft and session hijacking. Organizations could be exposed to attacks that may affect their reputation and data security.
Recommendation
It is recommended to update Liferay Portal and Liferay DXP to the latest versions that include security fixes. Additionally, an audit of forms should be conducted to identify and secure potential attack vectors.
Original NVD description (English source)
Stored cross-site scripting (XSS) vulnerability in Form widget configuration in Liferay Portal 7.1.0 through 7.3.0, and Liferay DXP 7.1 before fix pack 18, and 7.2 before fix pack 5 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a form's `name` field.