Description
Cross-site scripting (XSS) vulnerability in the Web Content Display widget's article selector in Liferay Liferay Portal 7.4.3.50, and Liferay DXP 7.4 update 50 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a web content article's `Title` field.
Remediation
References
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33942
Related Vulnerabilities
CVE-2020-1936 Vulnerability in maven package org.apache.ambari:ambari-web
CVE-2020-2247 Vulnerability in maven package org.jenkins-ci.plugins:klocwork
CVE-2022-23223 Vulnerability in maven package org.apache.shenyu:shenyu-common
CVE-2019-16556 Vulnerability in maven package org.jenkins-ci.plugins:rundeck
CVE-2023-50721 Vulnerability in maven package org.xwiki.platform:xwiki-platform-search-ui