CVE-2023-37940

Description

Cross-site scripting (XSS) vulnerability in the edit Service Access Policy page in Liferay Portal 7.0.0 through 7.4.3.87, and Liferay DXP 7.4 GA through update 87, 7.3 GA through update 29, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a service access policy's `Service Class` text field.

Reserved 2023-07-11 | Published 2024-12-17 | Updated 2024-12-17 | Assigner Liferay

Problem types

CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

Product status

Default status
unaffected

7.0.0
affected

Default status
unaffected

7.0.10
affected

7.1.10
affected

7.2.10
affected

7.3.10
affected

7.4.13
affected

Credits

milCERT AT reporter

Abderrahmane BOUNHIDJA reporter

References

liferay.dev/...-/asset_publisher/jekt/content/CVE-2023-37940

cve.org (CVE-2023-37940)

nvd.nist.gov (CVE-2023-37940)

Download JSON