cve-2023-42498
Vulnerability from cvelistv5
Published
2024-02-21 02:47
Modified
2024-08-02 19:23
Severity ?
9.6 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Summary
Reflected cross-site scripting (XSS) vulnerability in the Language Override edit screen in Liferay Portal 7.4.3.8 through 7.4.3.97, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 4 through 92 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_portal_language_override_web_internal_portlet_PLOPortlet_key parameter.
References
security@liferay.comhttps://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-42498Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-42498Vendor Advisory
Impacted products
Vendor Product Version
Liferay Portal Version: 7.4.3.8
 Create a notification for this product.
   Liferay DXP Version: 2023.q3.1
Version: 7.4.13.u4
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2023-42498",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-02-26T17:54:30.386431Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-06-04T17:25:12.034Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
         {
            providerMetadata: {
               dateUpdated: "2024-08-02T19:23:39.621Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-42498",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unaffected",
               product: "Portal",
               vendor: "Liferay",
               versions: [
                  {
                     lessThanOrEqual: "7.4.3.97",
                     status: "affected",
                     version: "7.4.3.8",
                     versionType: "maven",
                  },
               ],
            },
            {
               defaultStatus: "unaffected",
               product: "DXP",
               vendor: "Liferay",
               versions: [
                  {
                     lessThanOrEqual: "2023.q3.4",
                     status: "affected",
                     version: "2023.q3.1",
                     versionType: "maven",
                  },
                  {
                     lessThanOrEqual: "7.4.13.u92",
                     status: "affected",
                     version: "7.4.13.u4",
                     versionType: "maven",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               type: "reporter",
               user: "00000000-0000-4000-9000-000000000000",
               value: "Amin ACHOUR",
            },
         ],
         descriptions: [
            {
               lang: "en",
               supportingMedia: [
                  {
                     base64: false,
                     type: "text/html",
                     value: "Reflected cross-site scripting (XSS) vulnerability in the Language Override edit screen in Liferay Portal 7.4.3.8 through 7.4.3.97, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 4 through 92 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_portal_language_override_web_internal_portlet_PLOPortlet_key parameter.",
                  },
               ],
               value: "Reflected cross-site scripting (XSS) vulnerability in the Language Override edit screen in Liferay Portal 7.4.3.8 through 7.4.3.97, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 4 through 92 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_portal_language_override_web_internal_portlet_PLOPortlet_key parameter.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 9.6,
                  baseSeverity: "CRITICAL",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "CHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
                  version: "3.1",
               },
               format: "CVSS",
               scenarios: [
                  {
                     lang: "en",
                     value: "GENERAL",
                  },
               ],
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-79",
                     description: "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-02-21T02:47:45.261Z",
            orgId: "8b54e794-c6f0-462e-9faa-c1001a673ac3",
            shortName: "Liferay",
         },
         references: [
            {
               tags: [
                  "vendor-advisory",
               ],
               url: "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-42498",
            },
         ],
         source: {
            discovery: "UNKNOWN",
         },
         x_generator: {
            engine: "Vulnogram 0.1.0-dev",
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8b54e794-c6f0-462e-9faa-c1001a673ac3",
      assignerShortName: "Liferay",
      cveId: "CVE-2023-42498",
      datePublished: "2024-02-21T02:47:45.261Z",
      dateReserved: "2023-09-11T08:54:24.312Z",
      dateUpdated: "2024-08-02T19:23:39.621Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
   "vulnerability-lookup:meta": {
      nvd: "{\"cve\":{\"id\":\"CVE-2023-42498\",\"sourceIdentifier\":\"security@liferay.com\",\"published\":\"2024-02-21T03:15:08.240\",\"lastModified\":\"2025-01-28T02:47:39.277\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Reflected cross-site scripting (XSS) vulnerability in the Language Override edit screen in Liferay Portal 7.4.3.8 through 7.4.3.97, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 4 through 92 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_portal_language_override_web_internal_portlet_PLOPortlet_key parameter.\"},{\"lang\":\"es\",\"value\":\"Vulnerabilidad de cross-site scripting (XSS) reflejado en la pantalla de edición de Language Override en Liferay Portal 7.4.3.8 a 7.4.3.97, y Liferay DXP 2023.Q3 antes del parche 5, y 7.4 actualización 4 a 92 permite a atacantes remotos inyectar scripts web arbitrarios o HTML a través del parámetro _com_liferay_portal_language_override_web_internal_portlet_PLOPortlet_key.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security@liferay.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H\",\"baseScore\":9.6,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":6.0},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\",\"baseScore\":6.1,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":2.7}]},\"weaknesses\":[{\"source\":\"security@liferay.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"7.4.3.8\",\"versionEndExcluding\":\"7.4.3.98\",\"matchCriteriaId\":\"46868AAC-0BA9-43AB-9E7C-4080AFE04DF7\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update10:*:*:*:*:*:*\",\"matchCriteriaId\":\"C7B02106-D5EA-4A59-A959-CCE2AC8F55BC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update11:*:*:*:*:*:*\",\"matchCriteriaId\":\"80204464-5DC5-4A52-B844-C833A96E6BD4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update12:*:*:*:*:*:*\",\"matchCriteriaId\":\"6F8A5D02-0B45-4DA9-ACD8-42C1BFF62827\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update13:*:*:*:*:*:*\",\"matchCriteriaId\":\"38DA7C99-AC2C-4B9A-B611-4697159E1D79\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update14:*:*:*:*:*:*\",\"matchCriteriaId\":\"F264AD07-D105-4F00-8920-6D8146E4FA63\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update15:*:*:*:*:*:*\",\"matchCriteriaId\":\"C929CF16-4725-492A-872B-0928FE388FC9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update16:*:*:*:*:*:*\",\"matchCriteriaId\":\"1B8750A1-E481-48D4-84F4-97D1ABE15B46\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update17:*:*:*:*:*:*\",\"matchCriteriaId\":\"454F8410-D9AC-481E-841C-60F0DF2CC25E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update18:*:*:*:*:*:*\",\"matchCriteriaId\":\"D1A442EE-460F-4823-B9EF-4421050F0847\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update19:*:*:*:*:*:*\",\"matchCriteriaId\":\"608B205D-0B79-4D1C-B2C1-64C31DB1896E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update20:*:*:*:*:*:*\",\"matchCriteriaId\":\"4427DC78-E80C-4057-A295-B0731437A99E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update21:*:*:*:*:*:*\",\"matchCriteriaId\":\"22B6B8C1-1FF3-41BC-9576-16193AE20CC7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update22:*:*:*:*:*:*\",\"matchCriteriaId\":\"DDA17F24-1A7E-4BEB-9C98-41761A2A36A2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update23:*:*:*:*:*:*\",\"matchCriteriaId\":\"3B062851-CE6B-44F4-8222-422EC9872EC3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update24:*:*:*:*:*:*\",\"matchCriteriaId\":\"D4687FDA-0078-4E89-ADD8-7EDDA68261A4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update25:*:*:*:*:*:*\",\"matchCriteriaId\":\"7EA29B09-CC24-4063-96A5-96AA08C0886D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update26:*:*:*:*:*:*\",\"matchCriteriaId\":\"331FC246-D3E9-4711-B305-BE51BF743CF7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update27:*:*:*:*:*:*\",\"matchCriteriaId\":\"A5823BC0-8C11-4C31-9E99-3C9D82918E2A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update28:*:*:*:*:*:*\",\"matchCriteriaId\":\"E2E6CB66-1AE1-4626-8070-64C250ED8363\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update29:*:*:*:*:*:*\",\"matchCriteriaId\":\"B63449AA-6831-4290-B1FA-0BB806820402\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update30:*:*:*:*:*:*\",\"matchCriteriaId\":\"B3B169F6-B8B8-4612-AD7D-F75CC6A9297B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update31:*:*:*:*:*:*\",\"matchCriteriaId\":\"12D46756-D26D-4877-ACE8-1C2721908428\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update32:*:*:*:*:*:*\",\"matchCriteriaId\":\"5403DCEF-20C2-4568-8DF1-30804F522915\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update33:*:*:*:*:*:*\",\"matchCriteriaId\":\"90E39742-90BE-4DEB-AB78-F9B8F7333F9A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update34:*:*:*:*:*:*\",\"matchCriteriaId\":\"9D07DB20-9DCF-4C05-99D2-F6B37A082C14\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update35:*:*:*:*:*:*\",\"matchCriteriaId\":\"341D1157-8118-4BD3-A902-36E90E066706\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update36:*:*:*:*:*:*\",\"matchCriteriaId\":\"1AB71307-7EAA-436A-9CBC-5A94F034FB48\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update37:*:*:*:*:*:*\",\"matchCriteriaId\":\"9446B3A5-6647-416C-92AF-7B6E0E929765\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update38:*:*:*:*:*:*\",\"matchCriteriaId\":\"06386C7A-CAA1-4FC4-9182-5A66342FB903\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update39:*:*:*:*:*:*\",\"matchCriteriaId\":\"8C84B701-B9A1-43D0-AF0C-30EDBD24CF90\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update4:*:*:*:*:*:*\",\"matchCriteriaId\":\"182FAA46-D9FB-4170-B305-BAD0DF6E5DE9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update40:*:*:*:*:*:*\",\"matchCriteriaId\":\"BA9AF651-D118-4437-B400-531B26BF6801\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update41:*:*:*:*:*:*\",\"matchCriteriaId\":\"2B256485-E289-4092-B45B-835DE12625B9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update42:*:*:*:*:*:*\",\"matchCriteriaId\":\"119B54BD-75F4-46A4-A57D-16CFF4E12CEB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update43:*:*:*:*:*:*\",\"matchCriteriaId\":\"A3382E2D-A414-40A1-A330-619859756A36\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update44:*:*:*:*:*:*\",\"matchCriteriaId\":\"2E07B750-55B6-4DB6-B02B-216C2F5505A9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update45:*:*:*:*:*:*\",\"matchCriteriaId\":\"B921E670-480F-4793-A636-3855A1654908\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update46:*:*:*:*:*:*\",\"matchCriteriaId\":\"62AE52FE-FB7F-4339-BDDE-E5AD235BBC58\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update47:*:*:*:*:*:*\",\"matchCriteriaId\":\"C99508DB-19E9-4832-AB38-57C61C7D68BC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update48:*:*:*:*:*:*\",\"matchCriteriaId\":\"67F50AF8-7B0E-4D01-9EB2-C6625E9DACB6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update49:*:*:*:*:*:*\",\"matchCriteriaId\":\"131E4E65-D997-47F1-8CB8-15CE6A60AB1D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update5:*:*:*:*:*:*\",\"matchCriteriaId\":\"DF1BB9E6-D690-4C12-AEF0-4BD712869CBA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update50:*:*:*:*:*:*\",\"matchCriteriaId\":\"CCD1DEA0-8823-4780-B5EE-C1A2BB3C6B4F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update51:*:*:*:*:*:*\",\"matchCriteriaId\":\"94AC684E-3C5F-4859-B6EB-42C478F9DD11\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update52:*:*:*:*:*:*\",\"matchCriteriaId\":\"DC6FF5AB-B6E4-45D9-854B-29DEC200DA4D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update53:*:*:*:*:*:*\",\"matchCriteriaId\":\"9855E3CB-925E-4623-A776-59422AB2FC6A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update54:*:*:*:*:*:*\",\"matchCriteriaId\":\"01C3B7BE-1F9B-4EDA-990C-A4022CB85612\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update55:*:*:*:*:*:*\",\"matchCriteriaId\":\"65CF766C-626D-4F8C-BDBF-F0C5404DD545\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update56:*:*:*:*:*:*\",\"matchCriteriaId\":\"720EF24C-9A36-405B-A380-6114C150B376\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update57:*:*:*:*:*:*\",\"matchCriteriaId\":\"44479EF5-40BD-43A2-AD0F-CE1660222AB2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update58:*:*:*:*:*:*\",\"matchCriteriaId\":\"B8E0BD92-0F77-481E-8167-F81755E00703\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update59:*:*:*:*:*:*\",\"matchCriteriaId\":\"2BDB885E-814A-4CA8-A81C-1DB35989089B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update6:*:*:*:*:*:*\",\"matchCriteriaId\":\"653A0452-070F-4312-B94A-F5BCB01B9BDC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update60:*:*:*:*:*:*\",\"matchCriteriaId\":\"B73DA1AE-C62F-4E62-AA98-5697656825F9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update61:*:*:*:*:*:*\",\"matchCriteriaId\":\"D49DEE85-4DDB-4EF4-9F4D-11E7C1364055\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update62:*:*:*:*:*:*\",\"matchCriteriaId\":\"365F28B6-DBF2-45BB-A06D-DD80CFBAD7BD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update63:*:*:*:*:*:*\",\"matchCriteriaId\":\"5FDAD47C-C2DA-4533-AA58-DD6EC09A580A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update64:*:*:*:*:*:*\",\"matchCriteriaId\":\"5F81F36F-B20F-48B3-A1F2-3D319A34176B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update65:*:*:*:*:*:*\",\"matchCriteriaId\":\"754329CD-30B7-4410-A371-56A7C261B61B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update66:*:*:*:*:*:*\",\"matchCriteriaId\":\"C9445405-6B94-4DD1-BA94-B600AA316BB7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update67:*:*:*:*:*:*\",\"matchCriteriaId\":\"960F3F22-9CC8-4655-9B09-777E5A5A1239\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update68:*:*:*:*:*:*\",\"matchCriteriaId\":\"D2B77C89-7F33-47A0-B6BF-473366033BEA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update69:*:*:*:*:*:*\",\"matchCriteriaId\":\"8183B9D5-1C4D-4D30-BD85-13850FF34CB2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update7:*:*:*:*:*:*\",\"matchCriteriaId\":\"15B67345-D0AF-4BFD-A62D-870F75306A4F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update70:*:*:*:*:*:*\",\"matchCriteriaId\":\"1675366A-2388-4F7E-B423-D39BC7D3D38D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update71:*:*:*:*:*:*\",\"matchCriteriaId\":\"B93C3CF2-4F45-4F6C-AB6D-F9ABDA7C4DA8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update72:*:*:*:*:*:*\",\"matchCriteriaId\":\"34A6A6A0-9307-4F5D-9605-1F786D1CD62A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update73:*:*:*:*:*:*\",\"matchCriteriaId\":\"6B994132-7103-4132-9D90-11CA264FEDE3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update74:*:*:*:*:*:*\",\"matchCriteriaId\":\"A1958E04-AB8A-4B0E-AB45-B810CAED2EEF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update75:*:*:*:*:*:*\",\"matchCriteriaId\":\"BB5558B0-6714-4B3A-B287-1943517A975A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update76:*:*:*:*:*:*\",\"matchCriteriaId\":\"7E325115-EEBC-41F4-8606-45270DA40B98\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update77:*:*:*:*:*:*\",\"matchCriteriaId\":\"848B2C72-447D-46E2-A5A7-43CF3764E578\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update78:*:*:*:*:*:*\",\"matchCriteriaId\":\"26A0AF15-52A9-46FD-8157-359141332EAF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update79:*:*:*:*:*:*\",\"matchCriteriaId\":\"63D63872-C1D0-444F-BCC7-A514F323C256\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update8:*:*:*:*:*:*\",\"matchCriteriaId\":\"DE1F4262-A054-48CC-BF1D-AA77A94FFFE4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update80:*:*:*:*:*:*\",\"matchCriteriaId\":\"9D9FA9AD-39D3-412A-B794-E1B29EEEEC4A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update81:*:*:*:*:*:*\",\"matchCriteriaId\":\"294D8A56-A797-433C-A06E-106B2179151A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update82:*:*:*:*:*:*\",\"matchCriteriaId\":\"824D88D9-4645-4CAD-8CAB-30F27DD388C4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update83:*:*:*:*:*:*\",\"matchCriteriaId\":\"F6E8C952-B455-46E4-AC3D-D38CAF189F60\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update84:*:*:*:*:*:*\",\"matchCriteriaId\":\"CD77C0EE-AC79-4443-A502-C1E02F806911\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update85:*:*:*:*:*:*\",\"matchCriteriaId\":\"648EB53C-7A90-4DA6-BF1C-B5336CDE30C7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update86:*:*:*:*:*:*\",\"matchCriteriaId\":\"39835EF7-8E93-4695-973D-6E9B76C67372\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update87:*:*:*:*:*:*\",\"matchCriteriaId\":\"2A05FB86-332B-44E3-93CB-82465A38976E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update88:*:*:*:*:*:*\",\"matchCriteriaId\":\"7C754823-899C-4EEF-ACB7-E1551FA88B25\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update89:*:*:*:*:*:*\",\"matchCriteriaId\":\"493D4C18-DEE2-4040-9C13-3A9AB2CE47BF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update9:*:*:*:*:*:*\",\"matchCriteriaId\":\"D176CECA-2821-49EA-86EC-1184C133C0A3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update90:*:*:*:*:*:*\",\"matchCriteriaId\":\"8F17DD75-E63B-4E4C-B136-D43F17B389EF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update91:*:*:*:*:*:*\",\"matchCriteriaId\":\"62EE759A-78AD-40D6-8C5B-10403A8A4A89\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update92:*:*:*:*:*:*\",\"matchCriteriaId\":\"865ABA1F-CA99-4602-B325-F81C9778855C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:2023.q3.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B7B3A5E2-23CE-45A8-BD01-77024EB9F9A9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:2023.q3.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1EF6451A-2A5D-4222-A1C6-113AA4B8D4E6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:2023.q3.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9D6CE430-3C95-4855-BA44-E2E136D1FEB2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:2023.q3.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"44FEB149-C792-493D-B055-568FFC96298A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:2023.q3.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B050DD73-71B6-46CD-A35B-7ACB53BE6C6A\"}]}]}],\"references\":[{\"url\":\"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-42498\",\"source\":\"security@liferay.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-42498\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}",
      vulnrichment: {
         containers: "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-42498\", \"tags\": [\"vendor-advisory\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T19:23:39.621Z\"}}, {\"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-42498\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-02-26T17:54:30.386431Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-23T19:01:13.283Z\"}, \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"reporter\", \"user\": \"00000000-0000-4000-9000-000000000000\", \"value\": \"Amin ACHOUR\"}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 9.6, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Liferay\", \"product\": \"Portal\", \"versions\": [{\"status\": \"affected\", \"version\": \"7.4.3.8\", \"versionType\": \"maven\", \"lessThanOrEqual\": \"7.4.3.97\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Liferay\", \"product\": \"DXP\", \"versions\": [{\"status\": \"affected\", \"version\": \"2023.q3.1\", \"versionType\": \"maven\", \"lessThanOrEqual\": \"2023.q3.4\"}, {\"status\": \"affected\", \"version\": \"7.4.13.u4\", \"versionType\": \"maven\", \"lessThanOrEqual\": \"7.4.13.u92\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-42498\", \"tags\": [\"vendor-advisory\"]}], \"x_generator\": {\"engine\": \"Vulnogram 0.1.0-dev\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Reflected cross-site scripting (XSS) vulnerability in the Language Override edit screen in Liferay Portal 7.4.3.8 through 7.4.3.97, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 4 through 92 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_portal_language_override_web_internal_portlet_PLOPortlet_key parameter.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Reflected cross-site scripting (XSS) vulnerability in the Language Override edit screen in Liferay Portal 7.4.3.8 through 7.4.3.97, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 4 through 92 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_portal_language_override_web_internal_portlet_PLOPortlet_key parameter.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-79\", \"description\": \"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\"}]}], \"providerMetadata\": {\"orgId\": \"8b54e794-c6f0-462e-9faa-c1001a673ac3\", \"shortName\": \"Liferay\", \"dateUpdated\": \"2024-02-21T02:47:45.261Z\"}}}",
         cveMetadata: "{\"cveId\": \"CVE-2023-42498\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-08-02T19:23:39.621Z\", \"dateReserved\": \"2023-09-11T08:54:24.312Z\", \"assignerOrgId\": \"8b54e794-c6f0-462e-9faa-c1001a673ac3\", \"datePublished\": \"2024-02-21T02:47:45.261Z\", \"assignerShortName\": \"Liferay\"}",
         dataType: "CVE_RECORD",
         dataVersion: "5.1",
      },
   },
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.