CVE-2023-33941
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
Multiple cross-site scripting (XSS) vulnerabilities in the OAuth2ProviderApplicationRedirect class of the Plugin for OAuth 2.0 module in Liferay Portal 7.4.3.41 through 7.4.3.52 and Liferay DXP 7.4 update 41 through 52 allow remote attackers to inject arbitrary web scripts or HTML via the (1) code or (2) error parameter.
Risk Assessment
Attackers can exploit these vulnerabilities to perform XSS attacks, potentially leading to user data theft or session hijacking.
Recommendation
It is recommended to update to the latest version of Liferay to mitigate these vulnerabilities and implement input data filtering to minimize the risk of XSS attacks.
Original NVD description (English source)
Multiple cross-site scripting (XSS) vulnerabilities in the Plugin for OAuth 2.0 module's OAuth2ProviderApplicationRedirect class in Liferay Portal 7.4.3.41 through 7.4.3.52, and Liferay DXP 7.4 update 41 through 52 allow remote attackers to inject arbitrary web script or HTML via the (1) code, or (2) error parameter.