What is GHSA-53mw-69qx-q4fc?

GHSA-53mw-69qx-q4fc is a security advisory published by GitHub Security Advisories with Medium severity. Cross-site scripting in Liferay Portal

Which CVE IDs does GHSA-53mw-69qx-q4fc cover?

GHSA-53mw-69qx-q4fc covers the following CVE IDs: CVE-2023-33939. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-53mw-69qx-q4fc?

GHSA-53mw-69qx-q4fc has a CVSS v3 base score of 5.4, published by GitHub Security Advisories.

Which products are affected by GHSA-53mw-69qx-q4fc?

GHSA-53mw-69qx-q4fc affects 1 product, including: maven/com.liferay.portal:release.portal.bom:\u003e= 7.1.0, \u003c 7.4.3.13.

GHSA-53mw-69qx-q4fcMediumCVSS 5.4

Cross-site scripting in Liferay Portal

Vendor

GitHub Security Advisories

Published

May 24, 2023

Last Modified

November 6, 2023

🔗 CVE IDs covered (1)

CVE-2023-33939 →

📋 Description

Cross-site scripting (XSS) vulnerability in the Modified Facet widget in Liferay Portal 7.1.0 through 7.4.3.12, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 18, 7.3 before update 4, and 7.4 before update 9 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a facet label.

🎯 Affected products1

maven/com.liferay.portal:release.portal.bom:>= 7.1.0, < 7.4.3.13

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2023-33939
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33939
https://github.com/advisories/GHSA-53mw-69qx-q4fc