CVE-2023-33943
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
The Account module in Liferay Portal from versions 7.4.3.21 to 7.4.3.62 and Liferay DXP 7.4 from update 21 to 62 has a cross-site scripting (XSS) vulnerability. Attackers can inject arbitrary web scripts or HTML via crafted payloads in user text fields such as First Name, Middle Name, Last Name, or Job Title.
Risk Assessment
This vulnerability could lead to user data theft or session hijacking, posing a serious threat to organizational security. Attackers may exploit this flaw to introduce malicious code, impacting the company's reputation.
Recommendation
It is recommended to update Liferay Portal and Liferay DXP to the latest version to mitigate this vulnerability. Additionally, implementing input validation and sanitization mechanisms in user forms is advisable.
Original NVD description (English source)
Cross-site scripting (XSS) vulnerability in the Account module in Liferay Portal 7.4.3.21 through 7.4.3.62, and Liferay DXP 7.4 update 21 through 62 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a user's (1) First Name, (2) Middle Name, (3) Last Name, or (4) Job Title text field.