Description

Cross-site scripting (XSS) vulnerability in IFrame type Remote Apps in Liferay Portal 7.4.0 through 7.4.3.30, and Liferay DXP 7.4 before update 31 allows remote attackers to inject arbitrary web script or HTML via the Remote App's IFrame URL.

Remediation

References

https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33940

Related Vulnerabilities

CVE-2017-1000399 Vulnerability in maven package org.jenkins-ci.main:jenkins-core

CVE-2017-1000398 Vulnerability in maven package org.jenkins-ci.main:jenkins-core

CVE-2014-0230 Vulnerability in maven package org.apache.tomcat:tomcat-catalina

CVE-2014-0230 Vulnerability in maven package org.apache.tomcat:catalina

CVE-2014-3661 Vulnerability in maven package org.jenkins-ci.main:jenkins-core

Severity

Medium

Classification

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Tags

Vendor Advisory CWE-79