CVE-2023-33939

MediumCVSS 5.4

Published: 24/05/2023(UTC)Updated: 17/06/2026(UTC)Translated: 19/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.52%

40th percentile - higher than 40% of all known CVEs

Summary

XSS vulnerability in the Modified Facet widget in Liferay Portal from versions 7.1.0 to 7.4.3.12 and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 18, 7.3 before update 4, and 7.4 before update 9 allows remote attackers to inject arbitrary web scripts or HTML via a crafted payload injected into a facet label.

Risk Assessment

Attackers can exploit this vulnerability to perform XSS attacks, potentially leading to theft of user data or session hijacking.

Recommendation

It is recommended to update Liferay Portal and Liferay DXP to the latest versions that include security patches.

Original NVD description (English source)

Cross-site scripting (XSS) vulnerability in the Modified Facet widget in Liferay Portal 7.1.0 through 7.4.3.12, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 18, 7.3 before update 4, and 7.4 before update 9 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a facet label.