Arbitrary Script Injection Vulnerability in Liferay Portal

CVE-2023-42498

What is CVE-2023-42498?

A reflected cross-site scripting vulnerability exists in the Language Override edit screen of Liferay Portal and Liferay DXP. This issue affects Liferay Portal versions 7.4.3.8 to 7.4.3.97 and Liferay DXP 2023.Q3 prior to patch 5, as well as Liferay Portal 7.4 update 4 through 92. Attackers can exploit this vulnerability by injecting arbitrary web scripts or HTML code via the _com_liferay_portal_language_override_web_internal_portlet_PLOPortlet_key parameter, potentially compromising the security of the affected systems and users.

References