CVE-2023-33939
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
XSS vulnerability in the Modified Facet widget in Liferay Portal from versions 7.1.0 to 7.4.3.12 and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 18, 7.3 before update 4, and 7.4 before update 9 allows remote attackers to inject arbitrary web scripts or HTML via a crafted payload injected into a facet label.
Risk Assessment
Attackers can exploit this vulnerability to perform XSS attacks, potentially leading to theft of user data or session hijacking.
Recommendation
It is recommended to update Liferay Portal and Liferay DXP to the latest versions that include security patches.
Other vulnerabilities in Liferay Portal, Liferay DXP
See all- CVE-2025-43784Medium
An improper access control vulnerability in Liferay Portal 7.4.0 through 7.4.3.124 and Liferay DXP (2024.Q2.0-2024.Q2.8, 2024.Q1.1-2024.Q1.12, 7.4 GA through update 92) allows guest users to obtain object entries information via the API Builder.
- CVE-2023-33946Low
The Object module in Liferay Portal versions 7.4.3.4 to 7.4.3.48 and Liferay DXP 7.4 before update 49 does not properly isolate objects in different virtual instances. This allows remote authenticated users in one virtual instance to view objects in a different virtual instance via the OAuth 2 scope administration page.
Original NVD description (English source)
Cross-site scripting (XSS) vulnerability in the Modified Facet widget in Liferay Portal 7.1.0 through 7.4.3.12, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 18, 7.3 before update 4, and 7.4 before update 9 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a facet label.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS