Liferay Portal and Liferay DXP Cross-Site Scripting Vulnerability

A cross-site scripting (XSS) vulnerability has been identified in Liferay Portal versions 7.3.7 prior to 7.4.3.103, as well as in Liferay DXP versions 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, and 7.3 service pack 3 through update 36. This vulnerability allows remote attackers to inject arbitrary web scripts or HTML. The injection occurs through crafted payloads placed in an Account Role's 'Title' text field or an Organization's 'Name' text field. Exploitation of this vulnerability can lead to unauthorized viewing or selection of account or organization pages.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where injected scripts are executed in the context of the user's browser.

Remediation

Users can upgrade to Liferay Portal 7.4.3.104 or Liferay DXP versions 2024.Q1.1, 2023.Q4.0, or 2023.Q3.5 to address this vulnerability.