Liferay Portal and Liferay DXP Cross-Site Scripting Vulnerability in Web Content Templates

A cross-site scripting (XSS) vulnerability has been identified in the web content template's select structure page within Liferay Portal versions 7.4.3.35 to 7.4.3.111, and Liferay DXP versions 2023.Q4.0 to 2023.Q4.10, 2023.Q3.1 to 2023.Q3.10, and 7.4 update 35 to update 92. This vulnerability allows remote attackers to inject arbitrary web scripts or HTML by crafting a payload that is injected into a user's First Name, Middle Name, or Last Name text field.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.

Remediation

Users can upgrade to Liferay Portal 7.4.3.112 or Liferay DXP 2024.Q1.1 to address this vulnerability.