Description
Cross-site scripting (XSS) vulnerability in the App Builder module's custom object details page in Liferay Portal and Liferay DXP allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into an App Builder custom object's `Name` field.
Severity
4.8 (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N)
Affected Version(s)
- Liferay DXP 7.3 before update 14
- Liferay Portal 7.3.0 - 7.3.7
- Liferay Portal 7.4.0
Fixed Version(s)
- Liferay DXP 7.3 fix pack 14
- Liferay Portal 7.4.1
Acknowledgments
This issue was reported by Duy Huynh
Publication date: Wed, 24 May 2023 07:00:00 +0000