CVE-2023-33938
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
A cross-site scripting (XSS) vulnerability exists in the App Builder module's custom object details page in Liferay Portal 7.3.0 through 7.4.0, and Liferay DXP 7.3 before update 14. Remote attackers can inject arbitrary web scripts or HTML via a crafted payload injected into an App Builder custom object's 'Name' field.
Risk Assessment
This vulnerability allows remote attackers to execute unauthorized code in users' browsers, potentially leading to data theft or session hijacking. Organizations should be aware of the risks associated with this vulnerability.
Recommendation
It is recommended to update Liferay Portal to version 7.4.0 or apply appropriate patches in version 7.3.0 to mitigate the risks associated with this vulnerability.
Original NVD description (English source)
Cross-site scripting (XSS) vulnerability in the App Builder module's custom object details page in Liferay Portal 7.3.0 through 7.4.0, and Liferay DXP 7.3 before update 14 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into an App Builder custom object's `Name` field.