Liferay Portal and Liferay DXP Cross-Site Scripting Vulnerability in Web Content Templates

A cross-site scripting (XSS) vulnerability has been identified in web content templates of Liferay Portal and Liferay DXP. This vulnerability allows remote authenticated users to inject arbitrary web scripts or HTML. The issue arises from a crafted payload being injected into a web content structure's Name text field. Affected versions include Liferay Portal 7.4.3.4 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the content.

Remediation

Users can upgrade to Liferay Portal 7.4.3.112, Liferay DXP 2024.Q1.1, Liferay DXP 2023.Q4.5, or Liferay DXP 2023.Q3.9.