CVE-2023-44310

published 2023-10-17

CVE-2023-44310: Stored cross-site scripting (XSS) vulnerability in Page Tree menu Liferay Portal 7.3.6 through 7.4.3.78, and Liferay DXP 7.3 fix pack 1 through update 23, and…

medium 5.4 CVSS 3.1

AV N AC L PR L UI R S C C L I L A N

Stored cross-site scripting (XSS) vulnerability in Page Tree menu Liferay Portal 7.3.6 through 7.4.3.78, and Liferay DXP 7.3 fix pack 1 through update 23, and 7.4 before update 79 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into page's "Name" text field.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
liferay	digital_experience_platform	—	—
liferay	digital_experience_platform	—	—
liferay	dxp	7.3.10.sp1 – 7.3.10.u23	—
liferay	dxp	7.4.13 – 7.4.13.u78	—
liferay	liferay_portal	>= 7.3.6 < 7.4.3.49	7.4.3.49
liferay	portal	7.3.6 – 7.4.3.78	—

CWE-79