GHSA-qxf6-mp24-52cv

Suggest an improvement
Source
https://github.com/advisories/GHSA-qxf6-mp24-52cv
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/06/GHSA-qxf6-mp24-52cv/GHSA-qxf6-mp24-52cv.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-qxf6-mp24-52cv
Aliases
Published
2023-06-15T06:30:17Z
Modified
2025-08-08T21:43:25.889487Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
Liferay Portal and Liferay DXP Vulnerable to XSS via the Layout Module
Details

Cross-site scripting (XSS) vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.73, and Liferay DXP 7.4 update 70 through 73 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_layout_admin_web_portlet_GroupPagesPortlet_backURL parameter.

Database specific 
{
    "nvd_published_at": "2023-06-15T04:15:34Z",
    "cwe_ids": [
        "CWE-79"
    ],
    "github_reviewed_at": "2025-08-08T21:12:42Z",
    "severity": "MODERATE",
    "github_reviewed": true
}
References

Affected packages

Maven / com.liferay.portal:release.portal.bom

Package

Name
com.liferay.portal:release.portal.bom
View open source insights on deps.dev
Purl
pkg:maven/com.liferay.portal/release.portal.bom

Affected ranges

Type
ECOSYSTEM
Events
Introduced
7.4.3.70-ga70
Fixed
7.4.3.74-ga74

Affected versions

7.*
7.4.3.71
7.4.3.72
7.4.3.73
7.4.3.74

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/06/GHSA-qxf6-mp24-52cv/GHSA-qxf6-mp24-52cv.json"

Maven / com.liferay.portal:release.dxp.bom

Package

Name
com.liferay.portal:release.dxp.bom
View open source insights on deps.dev
Purl
pkg:maven/com.liferay.portal/release.dxp.bom

Affected ranges

Type
ECOSYSTEM
Events
Introduced
7.4.13.u70
Last affected
7.4.13.u73

Affected versions

7.*
7.4.13.u70
7.4.13.u71
7.4.13.u72
7.4.13.u73

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/06/GHSA-qxf6-mp24-52cv/GHSA-qxf6-mp24-52cv.json"