CVE-2023-40191

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2023-40191

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-40191.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2023-40191

Aliases

GHSA-468x-frcm-ghx6

Published

2024-02-21T03:15:07.870Z

Modified

2026-07-08T06:29:02.893707115Z

Severity

6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

[none]

Details

Reflected cross-site scripting (XSS) vulnerability in the instance settings for Accounts in Liferay Portal 7.4.3.44 through 7.4.3.97, and Liferay DXP 2023.Q3 before patch 6, and 7.4 update 44 through 92 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into the “Blocked Email Domains” text field

Database specific

{
    "unresolved_ranges": [
        {
            "cpes": [
                "cpe:2.3:a:liferay:digital_experience_platform:2023.q3.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:2023.q3.1:*:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:2023.q3.2:*:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:2023.q3.3:*:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:2023.q3.4:*:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:2023.q3.5:*:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update44:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update45:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update46:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update47:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update48:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update49:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update50:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update51:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update52:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update53:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update54:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update55:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update56:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update57:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update58:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update59:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update60:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update61:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update62:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update63:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update64:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update65:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update66:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update67:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update68:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update69:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update70:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update71:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update72:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update73:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update74:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update75:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update76:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update77:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update78:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update79:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update80:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update81:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update82:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update83:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update84:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update85:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update86:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update87:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update88:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update89:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update90:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update91:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update92:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "7.4-update44"
                },
                {
                    "last_affected": "7.4-update44"
                },
                {
                    "introduced": "7.4-update45"
                },
                {
                    "last_affected": "7.4-update45"
                },
                {
                    "introduced": "7.4-update46"
                },
                {
                    "last_affected": "7.4-update46"
                },
                {
                    "introduced": "7.4-update47"
                },
                {
                    "last_affected": "7.4-update47"
                },
                {
                    "introduced": "7.4-update48"
                },
                {
                    "last_affected": "7.4-update48"
                },
                {
                    "introduced": "7.4-update49"
                },
                {
                    "last_affected": "7.4-update49"
                },
                {
                    "introduced": "7.4-update50"
                },
                {
                    "last_affected": "7.4-update50"
                },
                {
                    "introduced": "7.4-update51"
                },
                {
                    "last_affected": "7.4-update51"
                },
                {
                    "introduced": "7.4-update52"
                },
                {
                    "last_affected": "7.4-update52"
                },
                {
                    "introduced": "7.4-update53"
                },
                {
                    "last_affected": "7.4-update53"
                },
                {
                    "introduced": "7.4-update54"
                },
                {
                    "last_affected": "7.4-update54"
                },
                {
                    "introduced": "7.4-update55"
                },
                {
                    "last_affected": "7.4-update55"
                },
                {
                    "introduced": "7.4-update56"
                },
                {
                    "last_affected": "7.4-update56"
                },
                {
                    "introduced": "7.4-update57"
                },
                {
                    "last_affected": "7.4-update57"
                },
                {
                    "introduced": "7.4-update58"
                },
                {
                    "last_affected": "7.4-update58"
                },
                {
                    "introduced": "7.4-update59"
                },
                {
                    "last_affected": "7.4-update59"
                },
                {
                    "introduced": "7.4-update60"
                },
                {
                    "last_affected": "7.4-update60"
                },
                {
                    "introduced": "7.4-update61"
                },
                {
                    "last_affected": "7.4-update61"
                },
                {
                    "introduced": "7.4-update62"
                },
                {
                    "last_affected": "7.4-update62"
                },
                {
                    "introduced": "7.4-update63"
                },
                {
                    "last_affected": "7.4-update63"
                },
                {
                    "introduced": "7.4-update64"
                },
                {
                    "last_affected": "7.4-update64"
                },
                {
                    "introduced": "7.4-update65"
                },
                {
                    "last_affected": "7.4-update65"
                },
                {
                    "introduced": "7.4-update66"
                },
                {
                    "last_affected": "7.4-update66"
                },
                {
                    "introduced": "7.4-update67"
                },
                {
                    "last_affected": "7.4-update67"
                },
                {
                    "introduced": "7.4-update68"
                },
                {
                    "last_affected": "7.4-update68"
                },
                {
                    "introduced": "7.4-update69"
                },
                {
                    "last_affected": "7.4-update69"
                },
                {
                    "introduced": "7.4-update70"
                },
                {
                    "last_affected": "7.4-update70"
                },
                {
                    "introduced": "7.4-update71"
                },
                {
                    "last_affected": "7.4-update71"
                },
                {
                    "introduced": "7.4-update72"
                },
                {
                    "last_affected": "7.4-update72"
                },
                {
                    "introduced": "7.4-update73"
                },
                {
                    "last_affected": "7.4-update73"
                },
                {
                    "introduced": "7.4-update74"
                },
                {
                    "last_affected": "7.4-update74"
                },
                {
                    "introduced": "7.4-update75"
                },
                {
                    "last_affected": "7.4-update75"
                },
                {
                    "introduced": "7.4-update76"
                },
                {
                    "last_affected": "7.4-update76"
                },
                {
                    "introduced": "7.4-update77"
                },
                {
                    "last_affected": "7.4-update77"
                },
                {
                    "introduced": "7.4-update78"
                },
                {
                    "last_affected": "7.4-update78"
                },
                {
                    "introduced": "7.4-update79"
                },
                {
                    "last_affected": "7.4-update79"
                },
                {
                    "introduced": "7.4-update80"
                },
                {
                    "last_affected": "7.4-update80"
                },
                {
                    "introduced": "7.4-update81"
                },
                {
                    "last_affected": "7.4-update81"
                },
                {
                    "introduced": "7.4-update82"
                },
                {
                    "last_affected": "7.4-update82"
                },
                {
                    "introduced": "7.4-update83"
                },
                {
                    "last_affected": "7.4-update83"
                },
                {
                    "introduced": "7.4-update84"
                },
                {
                    "last_affected": "7.4-update84"
                },
                {
                    "introduced": "7.4-update85"
                },
                {
                    "last_affected": "7.4-update85"
                },
                {
                    "introduced": "7.4-update86"
                },
                {
                    "last_affected": "7.4-update86"
                },
                {
                    "introduced": "7.4-update87"
                },
                {
                    "last_affected": "7.4-update87"
                },
                {
                    "introduced": "7.4-update88"
                },
                {
                    "last_affected": "7.4-update88"
                },
                {
                    "introduced": "7.4-update89"
                },
                {
                    "last_affected": "7.4-update89"
                },
                {
                    "introduced": "7.4-update90"
                },
                {
                    "last_affected": "7.4-update90"
                },
                {
                    "introduced": "7.4-update91"
                },
                {
                    "last_affected": "7.4-update91"
                },
                {
                    "introduced": "7.4-update92"
                },
                {
                    "last_affected": "7.4-update92"
                },
                {
                    "introduced": "2023.q3.0"
                },
                {
                    "last_affected": "2023.q3.0"
                },
                {
                    "introduced": "2023.q3.1"
                },
                {
                    "last_affected": "2023.q3.1"
                },
                {
                    "introduced": "2023.q3.2"
                },
                {
                    "last_affected": "2023.q3.2"
                },
                {
                    "introduced": "2023.q3.3"
                },
                {
                    "last_affected": "2023.q3.3"
                },
                {
                    "introduced": "2023.q3.4"
                },
                {
                    "last_affected": "2023.q3.4"
                },
                {
                    "introduced": "2023.q3.5"
                },
                {
                    "last_affected": "2023.q3.5"
                }
            ],
            "vendor_product": "liferay:digital_experience_platform",
            "source": "CPE_STRING"
        }
    ]
}

References

https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-40191

Affected packages

Git / github.com/liferay/liferay-portal

Affected ranges

Type

GIT

Repo

https://github.com/liferay/liferay-portal

Events

Introduced

12c3c28e530cc92fb8b50e1fb1dd452f005e8381

Fixed

7e32d8d73be262d4e03e7c11cf77d924c87742ee

Database specific

{
    "cpe": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "7.4.3.44"
        },
        {
            "fixed": "7.4.3.98"
        }
    ],
    "source": "CPE_RANGE"
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-40191.json"