CVE-2023-44311
Liferay Portal and Liferay DXP Vulnerable to XSS via the OAuth2ProviderApplicationRedirect Class
Summary
Remediation
Upgrade to the fixed version using your package manager.
<!-- Update pom.xml dependency version to 4.0.51 for com.liferay:com.liferay.oauth2.provider.rest -->
<!-- Update pom.xml dependency version to 7.4.13.u90 for com.liferay.portal:release.dxp.bom -->
After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.
Affected Packages (2)
| Package | Ecosystem | Affected | Fixed In |
|---|---|---|---|
| com.liferay:com.liferay.oauth2.provider.rest | maven | 1.0.0, 1.0.1, 1.0.10, 1.0.11 (+247 more) | 4.0.51 |
| com.liferay.portal:release.dxp.bom | maven | 7.4.13.u41, 7.4.13.u42, 7.4.13.u43, 7.4.13.u44 (+45 more) | 7.4.13.u90 |
Vulnerability Classification
Common Weakness Enumeration (CWE) identifiers for this vulnerability type.
- CWE-79Cross-site Scripting (XSS)MITRE
CVSS Score Breakdown
What the CVSS (Common Vulnerability Scoring System) 9.6 score means for each attack dimension.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
References
- https://nvd.nist.gov/vuln/detail/CVE-2023-44311ADVISORY
- https://github.com/liferay/liferay-portal/commit/c07e48d9f489b24e97e71139ac5aa7ef339d9ee9WEB
- https://github.com/liferay/liferay-portalPACKAGE
- https://liferay.atlassian.net/browse/LPE-17804WEB
- https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-44311WEB
- https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-44311?p_r_p_assetEntryId=122124899&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D122124899%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3DfalseWEB
Frequently Asked Questions
- What is CVE-2023-44311?
- Liferay Portal and Liferay DXP Vulnerable to XSS via the OAuth2ProviderApplicationRedirect Class This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.6/10).
- How do I check if my project is affected by CVE-2023-44311?
- CVE-2023-44311 affects com.liferay:com.liferay.oauth2.provider.rest and com.liferay.portal:release.dxp.bom. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2023-44311 and 200,000+ other known vulnerabilities.
Severity & Exploitability
Exploitation is straightforward and causes maximum impact. Patch immediately.
Also Known As
Related CVEs
- CVE-2023-42498CRITICAL
Liferay Portal Language Override edit screen and Liferay DXP vulnerable to reflected Cross-site Scripting
- CVE-2024-25145CRITICAL
Liferay Portal stored cross-site scripting (XSS) vulnerability
- CVE-2024-8980CRITICAL
Liferay Portal and Liferay DXP Vulnerable to CSRF in the Script Console
- CVE-2024-25601CRITICAL
Liferay Portal Expando module and Liferay DXP vulnerable to stored Cross-site Scripting
- CVE-2023-42628CRITICAL
Liferay Portal and Liferay DXP Vulnerable to XSS in the Wiki Widget
- CVE-2022-42122CRITICAL
Liferay Portal and Liferay DXP Vulnerable to SQL Injection via Friendly URL Module
- CVE-2024-25152CRITICAL
Liferay Portal Message Board widget and Liferay DXP vulnerable to stored Cross-site Scripting
- CVE-2024-26273HIGH
Liferay Portal and Liferay DXP Vulnerable to Cross-Site Request Forgery (CSRF) via the Content Page Editor
Check if you're affected
Scan your dependencies to see if this vulnerability affects your projects.
Scan Your Dependencies