SB2023101807 - Stored cross-site scripting in Liferay DXP and Liferay Portal

Security Bulletin ID SB2023101807

Severity

Low

Patch available

YES

Number of vulnerabilities 1

Exploitation vector Remote access

Highest impact Data manipulation

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 1 security vulnerability.

1) Stored cross-site scripting (CVE-ID: CVE-2023-42627)

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data in the Commerce module. A remote attacker can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

The vulnerability affects the following fields:

Shipping Name
Shipping Phone Numbe
Shipping Address
Shipping Address 2
Shipping Address 3
Shipping Zip
Shipping City
Shipping Region
Shipping Country
Billing Name
Billing Phone Number
Billing Address
Billing Address 2
Billing Address 3
Billing Zip
Billing City
Billing Region
Billing Country
Region Code

Remediation

Install update from vendor's website.

References

https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-42627