Description
Cross-site scripting (XSS) vulnerability in the Account module in Liferay Portal 7.4.3.21 through 7.4.3.62, and Liferay DXP 7.4 update 21 through 62 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a user's (1) First Name, (2) Middle Name, (3) Last Name, or (4) Job Title text field.
Remediation
References
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33943
Related Vulnerabilities
CVE-2023-20866 Vulnerability in maven package org.springframework.session:spring-session-core
CVE-2020-5397 Vulnerability in maven package org.springframework:spring-webflux
CVE-2020-27216 Vulnerability in maven package org.eclipse.jetty:jetty-webapp
CVE-2017-18354 Vulnerability in npm package rendertron-middleware
CVE-2023-49377 Vulnerability in maven package com.jfinal:jfinal