CVE-2023-33940

EUVD-2023-1649
Cross-site scripting (XSS) vulnerability in IFrame type Remote Apps in Liferay Portal 7.4.0 through 7.4.3.30, and Liferay DXP 7.4 before update 31 allows remote attackers to inject arbitrary web script or HTML via the Remote App's IFrame URL.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.8 MEDIUM
NETWORK
LOW
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
LiferayCNA
4.8 MEDIUM
NETWORK
LOW
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 29%
Affected Products (NVD)
VendorProductVersion
liferaydigital_experience_platform
7.4
liferaydigital_experience_platform
7.4:update1
liferaydigital_experience_platform
7.4:update10
liferaydigital_experience_platform
7.4:update11
liferaydigital_experience_platform
7.4:update12
liferaydigital_experience_platform
7.4:update13
liferaydigital_experience_platform
7.4:update14
liferaydigital_experience_platform
7.4:update15
liferaydigital_experience_platform
7.4:update16
liferaydigital_experience_platform
7.4:update17
liferaydigital_experience_platform
7.4:update18
liferaydigital_experience_platform
7.4:update19
liferaydigital_experience_platform
7.4:update2
liferaydigital_experience_platform
7.4:update20
liferaydigital_experience_platform
7.4:update21
liferaydigital_experience_platform
7.4:update22
liferaydigital_experience_platform
7.4:update23
liferaydigital_experience_platform
7.4:update24
liferaydigital_experience_platform
7.4:update25
liferaydigital_experience_platform
7.4:update26
liferaydigital_experience_platform
7.4:update27
liferaydigital_experience_platform
7.4:update28
liferaydigital_experience_platform
7.4:update29
liferaydigital_experience_platform
7.4:update3
liferaydigital_experience_platform
7.4:update30
liferaydigital_experience_platform
7.4:update4
liferaydigital_experience_platform
7.4:update5
liferaydigital_experience_platform
7.4:update6
liferaydigital_experience_platform
7.4:update7
liferaydigital_experience_platform
7.4:update8
liferaydigital_experience_platform
7.4:update9
liferayliferay_portal
7.4.0 ≤
𝑥
≤ 7.4.3.30
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33940
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33940