CVE-2023-42497

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-42497
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-42497.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-42497
Aliases
Published
2023-10-17T08:15:09.437Z
Modified
2026-07-08T06:27:13.056670649Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

Reflected cross-site scripting (XSS) vulnerability on the Export for Translation page in Liferay Portal 7.4.3.4 through 7.4.3.85, and Liferay DXP 7.4 before update 86 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_translation_web_internal_portlet_TranslationPortlet_redirect parameter.

Database specific 
{
    "unresolved_ranges": [
        {
            "source": "CPE_STRING",
            "extracted_events": [
                {
                    "introduced": "7.4-NA"
                },
                {
                    "last_affected": "7.4-NA"
                },
                {
                    "introduced": "7.4-update1"
                },
                {
                    "last_affected": "7.4-update1"
                },
                {
                    "introduced": "7.4-update21"
                },
                {
                    "last_affected": "7.4-update21"
                },
                {
                    "introduced": "7.4-update34"
                },
                {
                    "last_affected": "7.4-update34"
                },
                {
                    "introduced": "7.4-update36"
                },
                {
                    "last_affected": "7.4-update36"
                },
                {
                    "introduced": "7.4-update41"
                },
                {
                    "last_affected": "7.4-update41"
                },
                {
                    "introduced": "7.4-update48"
                },
                {
                    "last_affected": "7.4-update48"
                },
                {
                    "introduced": "7.4-update50"
                },
                {
                    "last_affected": "7.4-update50"
                },
                {
                    "introduced": "7.4-update52"
                },
                {
                    "last_affected": "7.4-update52"
                },
                {
                    "introduced": "7.4-update62"
                },
                {
                    "last_affected": "7.4-update62"
                },
                {
                    "introduced": "7.4-update67"
                },
                {
                    "last_affected": "7.4-update67"
                },
                {
                    "introduced": "7.4-update76"
                },
                {
                    "last_affected": "7.4-update76"
                },
                {
                    "introduced": "7.4-update81"
                },
                {
                    "last_affected": "7.4-update81"
                },
                {
                    "introduced": "7.4-update82"
                },
                {
                    "last_affected": "7.4-update82"
                },
                {
                    "introduced": "7.4-update83"
                },
                {
                    "last_affected": "7.4-update83"
                },
                {
                    "introduced": "7.4-update84"
                },
                {
                    "last_affected": "7.4-update84"
                },
                {
                    "introduced": "7.4-update85"
                },
                {
                    "last_affected": "7.4-update85"
                }
            ],
            "cpes": [
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:-:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update1:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update21:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update34:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update36:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update41:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update48:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update50:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update52:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update62:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update67:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update76:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update81:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update82:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update83:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update84:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update85:*:*:*:*:*:*"
            ],
            "vendor_product": "liferay:digital_experience_platform"
        }
    ]
}
References

Affected packages

Git / github.com/liferay/liferay-portal

Affected ranges

Type
GIT
Repo
https://github.com/liferay/liferay-portal
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
0f20ab121443b8c1e70c58285586d82ce48e7a8d
Database specific 
{
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "7.4.3.4"
        },
        {
            "fixed": "7.4.3.86"
        }
    ],
    "cpe": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*"
}

Affected versions

6.*
6.1.0-b1
6.1.0-b2
6.1.0-b3
6.1.0-b4
6.1.0-rc1
6.2.0-b1
6.2.0-b2
6.2.0-m2
6.2.0-m3
6.2.0-m4
6.2.0-m5
6.2.0-m6
7.*
7.0.0-m1
7.0.0-m2
7.0.0-m3
7.0.0-m4
7.0.0-m5
7.1.0-a1
7.1.0-a2
7.1.0-b1
7.1.0-b2
7.1.0-m1
7.1.0-m2
7.2.0-a1
7.2.0-b1
7.2.0-b2
7.2.0-b3
7.2.0-m2
7.3.0-ga1
7.3.1-ga2
7.3.2-ga3
7.3.3-ga4
7.3.4-ga5
7.3.5-ga6
7.4.0-ga1
7.4.1-ga2
7.4.2-ga3
7.4.3.4-ga4
7.4.3.41-ga41
7.4.3.5-ga5
7.4.3.6-ga6
7.4.3.7-ga7
sync-3.*
sync-3.0.0-b1
sync-3.0.1-b2
sync-3.0.10-ga2
sync-3.0.2-b3
sync-3.0.3-b4
sync-3.0.4-b5
sync-3.0.5-b6
sync-3.0.6-b7
sync-3.0.7-b8
sync-3.0.8-b9
sync-3.0.9-ga1
sync-3.1.0-ga1
Other
test-fix-pack-base-7310

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-42497.json"