Liferay Portal vulnerable to reflected XSS

CVE-2023-40191

Summary

A reflected cross-site scripting vulnerability exists in Liferay Portal and Liferay DXP that enables remote attackers to exploit the 'Blocked Email Domains' input field. By crafting a malicious payload, attackers can inject arbitrary scripts or HTML, potentially leading to various forms of attacks on users. This vulnerability affects multiple releases of Liferay Portal from version 7.4.3.44 through 7.4.3.97, as well as Liferay DXP 2023.Q3 prior to patch number 6. Effective remediation measures should be employed to prevent exploitation.

References