What is GHSA-mvfv-w3fq-xp67?

GHSA-mvfv-w3fq-xp67 is a security advisory published by GitHub Security Advisories with Medium severity. Cross-site scripting in Liferay Portal

Which CVE IDs does GHSA-mvfv-w3fq-xp67 cover?

GHSA-mvfv-w3fq-xp67 covers the following CVE IDs: CVE-2023-33941. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-mvfv-w3fq-xp67?

GHSA-mvfv-w3fq-xp67 has a CVSS v3 base score of 6.1, published by GitHub Security Advisories.

Which products are affected by GHSA-mvfv-w3fq-xp67?

GHSA-mvfv-w3fq-xp67 affects 1 product, including: maven/com.liferay.portal:release.portal.bom:\u003e= 7.4.3.41, \u003c 7.4.3.53.

GHSA-mvfv-w3fq-xp67MediumCVSS 6.1

Cross-site scripting in Liferay Portal

Vendor

GitHub Security Advisories

Published

May 24, 2023

Last Modified

November 6, 2023

🔗 CVE IDs covered (1)

CVE-2023-33941 →

📋 Description

Multiple cross-site scripting (XSS) vulnerabilities in the Plugin for OAuth 2.0 module's OAuth2ProviderApplicationRedirect class in Liferay Portal 7.4.3.41 through 7.4.3.52, and Liferay DXP 7.4 update 41 through 52 allow remote attackers to inject arbitrary web script or HTML via the (1) code, or (2) error parameter.

🎯 Affected products1

maven/com.liferay.portal:release.portal.bom:>= 7.4.3.41, < 7.4.3.53

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2023-33941
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33941
https://github.com/advisories/GHSA-mvfv-w3fq-xp67