CVE-2023-33944: XSS

Q: What is CVE-2023-33944?

CVE-2023-33944 is a cross-site scripting (XSS) vulnerability in the Layout module in Liferay Portal 7.3.4 through 7.4.3.68, and Liferay DXP 7.3 before update 24, and 7.4 before update 69.

Q: What is the severity of CVE-2023-33944?

The severity of CVE-2023-33944 is medium, with a severity value of 6.1.

Q: How does CVE-2023-33944 affect Liferay Portal?

CVE-2023-33944 allows remote attackers to inject arbitrary web script or HTML into a container type layout fragment's URL, leading to potential cross-site scripting attacks.

Q: Which versions of Liferay Portal are affected by CVE-2023-33944?

CVE-2023-33944 affects Liferay Portal versions 7.3.4 through 7.4.3.68.

Q: How can I fix CVE-2023-33944?

To fix CVE-2023-33944, it is recommended to update Liferay Portal to version 7.4.3.69 or the latest available patch.

Published May 24, 2023

Updated

Cross-site scripting (XSS) vulnerability in Layout module in Liferay Portal 7.3.4 through 7.4.3.68, and Liferay DXP 7.3 before update 24, and 7.4 before update 69 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a container type layout fragment's URL text field.

Affected Software

40 affected componentsFixes available

maven/com.liferay.portal:release.portal.bom>=7.3.4<7.4.3.69

7.4.3.69

Liferay Digital Experience Platform=7.3

Liferay Digital Experience Platform=7.3-fix_pack_1

Liferay Digital Experience Platform=7.3-fix_pack_2

Liferay Digital Experience Platform=7.4

Liferay Digital Experience Platform=7.4-update1

Liferay Digital Experience Platform=7.4-update21

Liferay Digital Experience Platform=7.4-update34

Liferay Digital Experience Platform=7.4-update36

Liferay Digital Experience Platform=7.4-update41

Liferay Digital Experience Platform=7.4-update50

Liferay Digital Experience Platform=7.4-update52

Liferay Digital Experience Platform=7.4-update62

Liferay Liferay Portal>=7.3.4<=7.4.3.68

Liferay Digital Experience Platform>=7.4.0<=7.4.3.68

Liferay Digital Experience Platform=7.3-update1

Liferay Digital Experience Platform=7.3-update10

Liferay Digital Experience Platform=7.3-update11

Liferay Digital Experience Platform=7.3-update12

Liferay Digital Experience Platform=7.3-update13

Liferay Digital Experience Platform=7.3-update14

Liferay Digital Experience Platform=7.3-update15

Liferay Digital Experience Platform=7.3-update16

Liferay Digital Experience Platform=7.3-update17

Liferay Digital Experience Platform=7.3-update18

Liferay Digital Experience Platform=7.3-update19

Liferay Digital Experience Platform=7.3-update2

Liferay Digital Experience Platform=7.3-update20

Liferay Digital Experience Platform=7.3-update21

Liferay Digital Experience Platform=7.3-update22

Liferay Digital Experience Platform=7.3-update23

Liferay Digital Experience Platform=7.3-update24

Liferay Digital Experience Platform=7.3-update3

Liferay Digital Experience Platform=7.3-update4

Liferay Digital Experience Platform=7.3-update5

Liferay Digital Experience Platform=7.3-update6

Liferay Digital Experience Platform=7.3-update7

Liferay Digital Experience Platform=7.3-update8

Liferay Digital Experience Platform=7.3-update9

Liferay Liferay Portal>=7.3.4<=7.3.7

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade maven/com.liferay.portal:release.portal.bom to a version that resolves this vulnerability.
Fixed in 7.4.3.69
Upgrade
Upgrade Liferay Portal Layout module to a version that resolves this vulnerability.
Fixed in 7.3.4 through 7.4.3.68
Upgrade
Upgrade Liferay DXP Layout module to a version that resolves this vulnerability.
Fixed in 7.3 before update 24
Upgrade
Upgrade Liferay DXP Layout module to a version that resolves this vulnerability.
Fixed in 7.4 before update 69
Configuration
In container type layout fragments, treat the `URL` text field as untrusted: apply input validation and output encoding/sanitization to prevent crafted payloads from injecting arbitrary web script or HTML.
Layout module (container type layout fragment) URL text field = Sanitize/validate input (prevent injection of arbitrary web script/HTML)

Event History

May 24, 2023

CVE Published

via MITRE·03:07 PM

Data Sourced

via MITRE·03:07 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:15 PM

DescriptionSeverityWeaknessAffected Software

Advisory Published

06:30 PM

Frequently Asked Questions

What is CVE-2023-33944?

CVE-2023-33944 is a cross-site scripting (XSS) vulnerability in the Layout module in Liferay Portal 7.3.4 through 7.4.3.68, and Liferay DXP 7.3 before update 24, and 7.4 before update 69.

What is the severity of CVE-2023-33944?