CVE-2023-33940

MediumCVSS 4.8

Published: 24/05/2023(UTC)Updated: 17/06/2026(UTC)Translated: 19/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.53%

40th percentile - higher than 40% of all known CVEs

Summary

A Cross-site scripting (XSS) vulnerability exists in Liferay Portal versions 7.4.0 through 7.4.3.30 and Liferay DXP 7.4 before update 31. This allows remote attackers to inject arbitrary web scripts or HTML via the Remote App's IFrame URL.

Risk Assessment

This vulnerability could lead to user data theft or session hijacking, posing a significant security risk to the organization.

Recommendation

It is recommended to update Liferay Portal and Liferay DXP to the latest version to mitigate this vulnerability and to monitor applications for unauthorized activities.

Original NVD description (English source)

Cross-site scripting (XSS) vulnerability in IFrame type Remote Apps in Liferay Portal 7.4.0 through 7.4.3.30, and Liferay DXP 7.4 before update 31 allows remote attackers to inject arbitrary web script or HTML via the Remote App's IFrame URL.