CVE-2023-33942

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-33942
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-33942.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-33942
Aliases
Published
2023-05-24T15:15:09.807Z
Modified
2026-07-08T06:46:42.423231554Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

Cross-site scripting (XSS) vulnerability in the Web Content Display widget's article selector in Liferay Liferay Portal 7.4.3.50, and Liferay DXP 7.4 update 50 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a web content article's Title field.

Database specific 
{
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "7.4-update50"
                },
                {
                    "last_affected": "7.4-update50"
                }
            ],
            "cpes": [
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update50:*:*:*:*:*:*"
            ],
            "source": "CPE_STRING",
            "vendor_product": "liferay:digital_experience_platform"
        }
    ]
}
References

Affected packages

Git / github.com/liferay/liferay-portal

Affected ranges

Type
GIT
Repo
https://github.com/liferay/liferay-portal
Events
Introduced
5df741fd6e2514e1269d539ed6c2c774672bda18
Last affected
5df741fd6e2514e1269d539ed6c2c774672bda18
Database specific 
{
    "cpe": "cpe:2.3:a:liferay:liferay_portal:7.4.3.50:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "7.4.3.50"
        },
        {
            "last_affected": "7.4.3.50"
        }
    ],
    "source": "CPE_STRING"
}

Affected versions

7.*
7.4.3.50
7.4.3.50-ga50

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-33942.json"