CVE-2023-33939: XSS
Cross-site scripting (XSS) vulnerability in the Modified Facet widget in Liferay Portal 7.1.0 through 7.4.3.12, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 18, 7.3 before update 4, and 7.4 before update 9 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a facet label.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/com.liferay.portal:release.portal.bomto a version that resolves this vulnerability.Fixed in 7.4.3.13 - Upgrade
Upgrade
Liferay Portal 7.1to a version that resolves this vulnerability.Patch fix pack 27 - Upgrade
Upgrade
Liferay Portal 7.2to a version that resolves this vulnerability.Patch fix pack 18 - Upgrade
Upgrade
Liferay Portal 7.3to a version that resolves this vulnerability.Patch update 4 - Upgrade
Upgrade
Liferay Portal 7.4to a version that resolves this vulnerability.Patch update 9
Event History
Frequently Asked Questions
What is CVE-2023-33939?
CVE-2023-33939 is a cross-site scripting (XSS) vulnerability in the Modified Facet widget in Liferay Portal 7.1.0 through 7.4.3.12, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 18, 7.3 before update 4, and 7.4 before update 9.
What is the severity of CVE-2023-33939?
The severity of CVE-2023-33939 is medium, with a severity value of 5.4.
How does CVE-2023-33939 affect Liferay Digital Experience Platform?
CVE-2023-33939 affects Liferay Digital Experience Platform versions 7.1 and 7.2, before fix pack 27 and fix pack 18 respectively.
How does CVE-2023-33939 affect Liferay Portal?
CVE-2023-33939 affects Liferay Portal versions 7.1.0 through 7.4.3.12.
How can I fix CVE-2023-33939?
To fix CVE-2023-33939, update Liferay Digital Experience Platform to at least fix pack 27 (for 7.1) or fix pack 18 (for 7.2), and Liferay Portal to at least version 7.4.3.12.