Description

Cross-site scripting (XSS) vulnerability in IFrame type Remote Apps in Liferay Portal 7.4.0 through 7.4.3.30, and Liferay DXP 7.4 before update 31 allows remote attackers to inject arbitrary web script or HTML via the Remote App's IFrame URL.

Remediation

References

https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33940

Related Vulnerabilities

CVE-2023-37950 Vulnerability in maven package com.mabl.integration.jenkins:mabl-integration

CVE-2023-43497 Vulnerability in maven package org.jenkins-ci.main:jenkins-core

CVE-2023-29016 Vulnerability in maven package io.goobi.viewer:viewer-core

CVE-2015-5322 Vulnerability in maven package org.jenkins-ci.main:jenkins-core

CVE-2020-11022 Vulnerability in npm package jquery

Severity

Medium

Classification

CWE-79 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Tags

Vendor Advisory