VULNERABILITY INTELLIGENCE

CVE-2023-42629

CVSS score9 CRITICAL

EPSS probability2.78%

CISA KEVNot currently listed

Published2023-10-17

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Description

Stored cross-site scripting (XSS) vulnerability in the manage vocabulary page in Liferay Portal 7.4.2 through 7.4.3.87, and Liferay DXP 7.4 before update 88 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a Vocabulary's 'description' text field.

Weakness classification

security@liferay.com: CWE-79
nvd@nist.gov: CWE-79

Primary references

security@liferay.com — Vendor Advisory
security@liferay.com — Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory