Liferay Portal and DXP Cross-Site Scripting Vulnerability in Rich Text Fields

A cross-site scripting (XSS) vulnerability has been identified in Liferay Portal versions 7.3.0 to 7.4.3.111, as well as in Liferay DXP versions 2023.Q4.0, 2023.Q3.1 to 2023.Q3.4, 7.4 GA through update 92, and 7.3 GA through update 36. This vulnerability allows remote attackers to inject arbitrary web scripts or HTML by exploiting 'Rich Text' fields in web content structures, Documents and Media Document Types, or custom assets using the Data Engine's Rich Text module.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Remediation

Users can upgrade to Liferay Portal 7.4.3.112 or Liferay DXP 2024.Q1.1, 2023.Q4.1, or 2023.Q3.5 to address this vulnerability.