VYPR
← All advisories
Medium severity6.1NVD Advisory· Published May 24, 2023· Updated Jun 17, 2026

CVE-2023-33941

CVE-2023-33941

Description

Multiple cross-site scripting (XSS) vulnerabilities in the Plugin for OAuth 2.0 module's OAuth2ProviderApplicationRedirect class in Liferay Portal 7.4.3.41 through 7.4.3.52, and Liferay DXP 7.4 update 41 through 52 allow remote attackers to inject arbitrary web script or HTML via the (1) code, or (2) error parameter.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
com.liferay.portal:release.portal.bomMaven
>= 7.4.3.41, < 7.4.3.537.4.3.53

Affected products

17
  • Liferay/Digital Experience Platform12 versions
    cpe:2.3:a:liferay:digital_experience_platform:7.4:update41:*:*:*:*:*:*+ 11 more
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update41:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update42:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update43:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update44:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update45:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update46:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update47:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update48:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update49:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update50:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update51:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update52:*:*:*:*:*:*
  • Liferay/Portal2 versions
    cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*range: >=7.4.3.41,<=7.4.3.52
    • (no CPE)range: 7.4.3.41
  • osv-coords2 versions
    pkg:bitnami/liferaypkg:maven/com.liferay.portal/release.portal.bom
    >= 7.4-update41.0, <= 7.4-update41.0+ 1 more
    • (no CPE)range: >= 7.4-update41.0, <= 7.4-update41.0
    • (no CPE)range: >= 7.4.3.41, < 7.4.3.53
  • Liferay/DXPcpe-rescue
    Range: 7.4.13.u41

Patches

Vulnerability mechanics

References

3

News mentions

0

No linked articles in our index yet.