CVE-2023-33944
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
A cross-site scripting (XSS) vulnerability exists in the Layout module in Liferay Portal versions 7.3.4 through 7.4.3.68 and Liferay DXP 7.3 before update 24 and 7.4 before update 69. It allows remote attackers to inject arbitrary web scripts or HTML via a crafted payload injected into a container type layout fragment's `URL` text field.
Risk Assessment
This vulnerability could lead to session hijacking, data theft, or the injection of malicious code on the site, posing a threat to the organization's security.
Recommendation
It is recommended to update Liferay Portal to the latest version to mitigate this vulnerability and to monitor the application for unauthorized activities.
Original NVD description (English source)
Cross-site scripting (XSS) vulnerability in Layout module in Liferay Portal 7.3.4 through 7.4.3.68, and Liferay DXP 7.3 before update 24, and 7.4 before update 69 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a container type layout fragment's `URL` text field.