CVE-2023-33942
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
CVE-2023-33942 describes a cross-site scripting (XSS) vulnerability in the Web Content Display widget's article selector in Liferay Portal 7.4.3.50 and Liferay DXP 7.4 update 50. It allows remote attackers to inject arbitrary web scripts or HTML via a crafted payload injected into a web content article's 'Title' field.
Risk Assessment
This vulnerability could lead to session hijacking, data theft, or the introduction of malware, posing a significant security threat to the organization.
Recommendation
It is recommended to update to the latest version of Liferay to mitigate this vulnerability and to monitor the application for potential XSS attack attempts.
Original NVD description (English source)
Cross-site scripting (XSS) vulnerability in the Web Content Display widget's article selector in Liferay Liferay Portal 7.4.3.50, and Liferay DXP 7.4 update 50 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a web content article's `Title` field.