Description
Cross-site scripting (XSS) vulnerability in IFrame type Remote Apps in Liferay Portal 7.4.0 through 7.4.3.30, and Liferay DXP 7.4 before update 31 allows remote attackers to inject arbitrary web script or HTML via the Remote App's IFrame URL.
Remediation
References
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33940
Related Vulnerabilities
CVE-2016-3674 Vulnerability in maven package com.thoughtworks.xstream:xstream
CVE-2020-2206 Vulnerability in maven package org.jenkins-ci.plugins:vncrecorder
CVE-2015-8854 Vulnerability in maven package org.webjars.npm:marked
CVE-2018-1000409 Vulnerability in maven package org.jenkins-ci.main:jenkins-core
CVE-2019-16568 Vulnerability in maven package hudson.plugins.sctmexecutor:sctmexecutor