Main Vulnerability Database Vulnerabilities #VU82177

Stored cross-site scripting in Liferay DXP and Liferay Enterprise Portal - CVE-2023-42627

Published: October 18, 2023

Vulnerability identifier: #VU82177

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

CVE-ID: CVE-2023-42627

CWE-ID: CWE-79

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data in the Commerce module. A remote attacker can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

The vulnerability affects the following fields:

Shipping Name
Shipping Phone Numbe
Shipping Address
Shipping Address 2
Shipping Address 3
Shipping Zip
Shipping City
Shipping Region
Shipping Country
Billing Name
Billing Phone Number
Billing Address
Billing Address 2
Billing Address 3
Billing Zip
Billing City
Billing Region
Billing Country
Region Code

Affected software

Liferay DXP
Liferay Enterprise Portal

How to mitigate CVE-2023-42627

Install update from vendor's website.

Liferay DXP - update to 7.4 update 92
Liferay Enterprise Portal - update to 7.4.3.92 ga92

External References

https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-42627

Related Security Bulletins