Liferay Portal and DXP Calendar Widget Cross-Site Scripting Vulnerability

A cross-site scripting (XSS) vulnerability has been identified in the Calendar widget of Liferay Portal and Liferay DXP. This vulnerability allows remote attackers to inject arbitrary web scripts or HTML. The issue arises when a crafted payload is injected into the 'Name' text field of a Calendar entry. Affected versions include Liferay Portal 7.4.3.35 through 7.4.3.110, Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through 2023.Q3.6, Liferay DXP 7.4 Update 35 through Update 92, and Liferay DXP 7.3 Update 25 through Update 36.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the Calendar.

Remediation

Users can upgrade to Liferay Portal 7.4.3.111, Liferay DXP 2024.Q1.1, Liferay DXP 2023.Q4.5, or Liferay DXP 2023.Q3.7 to address this vulnerability.