Liferay Portal vulnerable to reflected XSS

CVE-2023-40191

What is CVE-2023-40191?

A reflected cross-site scripting vulnerability exists in Liferay Portal and Liferay DXP that enables remote attackers to exploit the 'Blocked Email Domains' input field. By crafting a malicious payload, attackers can inject arbitrary scripts or HTML, potentially leading to various forms of attacks on users. This vulnerability affects multiple releases of Liferay Portal from version 7.4.3.44 through 7.4.3.97, as well as Liferay DXP 2023.Q3 prior to patch number 6. Effective remediation measures should be employed to prevent exploitation.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References