Liferay Portal and DXP Reflected Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified in Liferay Portal versions 7.4.3.102 to 7.4.3.110, as well as in Liferay DXP versions 2023.Q4.0 to 2023.Q4.2 and 2023.Q3.5. This vulnerability allows remote attackers to inject arbitrary web scripts or HTML. The issue arises on the page configuration page, where the 'com_liferay_layout_admin_web_portlet_GroupPagesPortlet_backURLTitle' parameter can be exploited.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Remediation

Users can upgrade to Liferay Portal 7.4.3.111, Liferay DXP 2024.Q1.1, Liferay DXP 2023.Q4.3, or Liferay DXP 2023.Q3.6 to address this vulnerability.