Description
Stored cross-site scripting (XSS) vulnerability in Form widget configuration in Liferay Portal, and Liferay DXP allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a form's `name` field.
Severity
5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Affected Version(s)
- Liferay DXP 7.1 before fix pack 18
- Liferay DXP 7.2 before fix pack 5
- Liferay Portal 7.1.0 - 7.1.3
- Liferay Portal 7.2.0 - 7.2.1
- Liferay Portal 7.3.0
Fixed Version(s)
- Liferay DXP 7.1 fix pack 18
- Liferay DXP 7.2 fix pack 5
- Liferay Portal 7.3.1
Publication date: Wed, 24 May 2023 07:00:00 +0000