CVE-2023-42497 — Vulnerability in...
Liferay Portal and Liferay DXP Vulnerable to Reflected XSS via the Export for Translation Page
Summary
Advisory Timeline
- First published October 17, 2023 (1091 days ago).
- Last revised August 8, 2025 — 662 days after initial publication.
Remediation
Upgrade to the fixed version using your package manager.
<!-- Update pom.xml dependency version to 2.0.86 for com.liferay:com.liferay.translation.web -->
<!-- Update pom.xml dependency version to 7.4.13.u86 for com.liferay.portal:release.dxp.bom -->
After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.
Affected Packages (2)
Affects 1 ecosystem: maven (2).
| Package | Ecosystem | Affected | Fixed In |
|---|---|---|---|
| com.liferay:com.liferay.translation.web | maven | 1.0.0, 1.0.1, 1.0.10, 1.0.11 (+115 more) | 2.0.86 |
| com.liferay.portal:release.dxp.bom | maven | 7.4.10.ep1, 7.4.11, 7.4.12, 7.4.13 (+81 more) | 7.4.13.u86 |
Vulnerability Classification
Common Weakness Enumeration (CWE) identifiers for this vulnerability type.
- CWE-79Cross-site Scripting (XSS)MITRE
CVSS Score Breakdown
What the CVSS (Common Vulnerability Scoring System) 9.6 score means for each attack dimension.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
References
- https://nvd.nist.gov/vuln/detail/CVE-2023-42497ADVISORY
- https://github.com/liferay/liferay-portalPACKAGE
- https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-42497?p_r_p_assetEntryId=122124913&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D122124913%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3DfalseWEB
Frequently Asked Questions
- What is CVE-2023-42497?
- Liferay Portal and Liferay DXP Vulnerable to Reflected XSS via the Export for Translation Page This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.6/10).
- How do I check if my project is affected by CVE-2023-42497?
- CVE-2023-42497 affects com.liferay:com.liferay.translation.web and com.liferay.portal:release.dxp.bom. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2023-42497 and 200,000+ other known vulnerabilities.
Severity & Exploitability
Exploitation is straightforward and causes maximum impact. Patch immediately.
Also Known As
Related CVEs
- CVE-2024-38002CRITICAL
Liferay Portal and Liferay DXP Workflow Component Does Not Check User Permissions
- CVE-2024-25603CRITICAL
Liferay Portal's Dynamic Data Mapping module's DDMForm and Liferay DXP vulnerable to stored Cross-site Scripting
- CVE-2023-40191CRITICAL
Liferay Portal and Liferay DXP vulnerable to reflected Cross-site Scripting
- CVE-2023-44311CRITICAL
Liferay Portal and Liferay DXP Vulnerable to XSS via the OAuth2ProviderApplicationRedirect Class
- CVE-2024-26266CRITICAL
Liferay Portal and Liferay DXP vulnerable to stored Cross-site Scripting
- CVE-2024-25602CRITICAL
Liferay Portal and Liferay DXP's Users Admin module vulnerable to stored Cross-site Scripting
- CVE-2024-25610CRITICAL
Liferay Portal has a Stored XSS with Blog entries (Insecure defaults)
- CVE-2024-25147CRITICAL
Liferay Portal and Liferay DXP vulnerable to Cross-site Scripting
Check if you're affected
Scan your dependencies to see if this vulnerability affects your projects.
Scan Your Dependencies