CVE-2023-42627

CRITICAL

Liferay Portal and Liferay DXP Vulnerable to XSS in the Commerce Module

Published October 17, 2023Updated July 29, 2025Source: osv

Summary

Multiple stored cross-site scripting (XSS) vulnerabilities in the Commerce module before 4.0.35 from Liferay Portal (7.3.5 through 7.4.3.91), and Liferay DXP 7.3 update 33 and earlier, and 7.4 before update 92 allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a (1) Shipping Name, (2) Shipping Phone Number, (3) Shipping Address, (4) Shipping Address 2, (5) Shipping Address 3, (6) Shipping Zip, (7) Shipping City, (8) Shipping Region (9), Shipping Country, (10) Billing Name, (11) Billing Phone Number, (12) Billing Address, (13) Billing Address 2, (14) Billing Address 3, (15) Billing Zip, (16) Billing City, (17) Billing Region, (18) Billing Country, or (19) Region Code.

Remediation

Upgrade to the fixed version using your package manager.

Maven

Update com.liferay.commerce:com.liferay.commerce.address.content.web to 4.0.35 or later

<!-- Update pom.xml dependency version to 4.0.35 for com.liferay.commerce:com.liferay.commerce.address.content.web -->

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (3)

Package	Ecosystem	Affected	Fixed In
com.liferay.portal:release.dxp.bom	maven	7.3.10, 7.3.10.ep3, 7.3.10.ep4, 7.3.10.ep5 (+36 more)	Range-based data available
com.liferay.commerce:com.liferay.commerce.address.content.web	maven	1.0.0, 1.0.1, 1.0.10, 1.0.11 (+98 more)	4.0.35
com.liferay.portal:release.dxp.bom	maven	7.4.10.ep1, 7.4.11, 7.4.12, 7.4.13 (+88 more)	Range-based data available

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-79
Cross-site Scripting (XSS)MITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.6 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2023-42627?: Liferay Portal and Liferay DXP Vulnerable to XSS in the Commerce Module This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.6/10).
How do I check if my project is affected by CVE-2023-42627?: CVE-2023-42627 affects com.liferay.portal:release.dxp.bom and com.liferay.commerce:com.liferay.commerce.address.content.web. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2023-42627 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

9.6

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-qp68-5v39-r869

BIT-liferay-2023-42627

Related CVEs

CVE-2024-25601
CRITICAL
Liferay Portal Expando module and Liferay DXP vulnerable to stored Cross-site Scripting
CVE-2023-42628
CRITICAL
Liferay Portal and Liferay DXP Vulnerable to XSS in the Wiki Widget
CVE-2022-42122
CRITICAL
Liferay Portal and Liferay DXP Vulnerable to SQL Injection via Friendly URL Module
CVE-2024-25152
CRITICAL
Liferay Portal Message Board widget and Liferay DXP vulnerable to stored Cross-site Scripting
CVE-2023-47795
CRITICAL
Liferay Portal Document and Media widget and Liferay DXP vulnerable to stored Cross-site Scripting
CVE-2022-42120
CRITICAL
Liferay Portal and Liferay DXP Vulnerable to SQL Injection via the Fragment Module
CVE-2024-26273
HIGH
Liferay Portal and Liferay DXP Vulnerable to Cross-Site Request Forgery (CSRF) via the Content Page Editor
CVE-2024-26272
HIGH
Liferay Portal and Liferay DXP Vulnerable to Cross-Site Request Forgery (CSRF) via the Content Page Editor

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies