Description
Cross-site scripting (XSS) vulnerability in the Account module in Liferay Portal 7.4.3.21 through 7.4.3.62, and Liferay DXP 7.4 update 21 through 62 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a user's (1) First Name, (2) Middle Name, (3) Last Name, or (4) Job Title text field.
Remediation
References
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33943
Related Vulnerabilities
CVE-2019-10434 Vulnerability in maven package com.mtvi.plateng.hudson:ldapemail
CVE-2014-4611 Vulnerability in maven package net.jpountz.lz4:lz4
CVE-2020-6460 Vulnerability in maven package org.webjars.npm:electron
CVE-2020-27216 Vulnerability in maven package jetty:jetty
CVE-2016-4055 Vulnerability in maven package org.fujion.webjars:moment