Liferay Portal and DXP Cross-Site Scripting Vulnerability in Calendar Events

A cross-site scripting (XSS) vulnerability has been identified in Liferay Portal versions 7.4.3.35 through 7.4.3.111, as well as in Liferay DXP versions 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.7, 7.4 update 35 through update 92, and 7.3 update 25 through update 36. This vulnerability allows remote attackers to inject arbitrary web scripts or HTML into a user's First Name, Middle Name, or Last Name text fields within Calendar events.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Remediation

Users can upgrade to Liferay Portal 7.4.3.112 or Liferay DXP versions 2024.Q1.1, 2023.Q4.6, or 2023.Q3.8 to address this vulnerability.