Open-source package vulnerability · Maven

CVE-2023-42498: Liferay Portal Language Override edit screen and Liferay DXP vulnerable to reflected Cross-site Scripting

criticalCVSS 3.1 9.6GHSA-73x3-8mrg-5r93

Reflected cross-site scripting (XSS) vulnerability in the Language Override edit screen in Liferay Portal 7.4.3.8 through 7.4.3.97, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 4 through 92 allows remote attackers to inject arbitrary web script or HTML via the comliferayportallanguageoverridewebinternalportletPLOPortletkey parameter.

Published Feb 21, 2024 · Updated Mar 20, 2026

Affected packages

com.liferay.portal:release.portal.bom

Ecosystem: Maven
Affected: >= 7.4.3.8, <= 7.4.3.97
Fixed in: 7.4.3.98
Check: mvn dependency:tree -Dincludes=com.liferay.portal:release.portal.bom

com.liferay.portal:release.dxp.bom

Ecosystem: Maven
Affected: >= 2023.Q3, < 2023.Q3.5
Fixed in: 2023.Q3.5
Check: mvn dependency:tree -Dincludes=com.liferay.portal:release.dxp.bom

com.liferay.portal:release.dxp.bom

Ecosystem: Maven
Affected: >= 7.4.13.u4, <= 7.4.13.u92
Fixed in: No patched version yet
Check: mvn dependency:tree -Dincludes=com.liferay.portal:release.dxp.bom

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Reflected cross-site scripting (XSS) vulnerability in the Language Override edit screen in Liferay Portal 7.4.3.8 through 7.4.3.97, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 4 through 92 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_portal_language_override_web_internal_portlet_PLOPortlet_key parameter.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More Maven vulnerabilities

All Maven entries