VYPR
← All advisories
Critical severity9.6NVD Advisory· Published Oct 17, 2023· Updated Jun 17, 2026

CVE-2023-42497

CVE-2023-42497

Description

Reflected cross-site scripting (XSS) vulnerability on the Export for Translation page in Liferay Portal 7.4.3.4 through 7.4.3.85, and Liferay DXP 7.4 before update 86 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_translation_web_internal_portlet_TranslationPortlet_redirect parameter.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
com.liferay:com.liferay.translation.webMaven
< 2.0.862.0.86
com.liferay.portal:release.dxp.bomMaven
>= 7.4.0, < 7.4.13.u867.4.13.u86

Affected products

23
  • Liferay/Digital Experience Platform17 versions
    cpe:2.3:a:liferay:digital_experience_platform:7.4:-:*:*:*:*:*:*+ 16 more
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:-:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update1:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update21:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update34:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update36:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update41:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update48:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update50:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update52:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update62:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update67:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update76:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update81:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update82:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update83:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update84:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update85:*:*:*:*:*:*
  • Liferay/Portal2 versions
    cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*range: >=7.4.3.4,<7.4.3.86
    • (no CPE)range: 7.4.3.4
  • osv-coords3 versions
    pkg:bitnami/liferaypkg:maven/com.liferay.portal/release.dxp.bompkg:maven/com.liferay/com.liferay.translation.web
    >= 7.4.0, <= 7.4.0+ 2 more
    • (no CPE)range: >= 7.4.0, <= 7.4.0
    • (no CPE)range: >= 7.4.0, < 7.4.13.u86
    • (no CPE)range: < 2.0.86
  • Liferay/DXPcpe-rescue
    Range: 7.4.13

Patches

Vulnerability mechanics

References

4

News mentions

0

No linked articles in our index yet.