Read the docs
TI-2023-16812 Aliases CVE-2023-33943GHSA-p9xg-9378-cqp7

Cross-site scripting in Liferay Portal

Priority LOW 25CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Cross-site scripting (XSS) vulnerability in the Account module in Liferay Portal 7.4.3.21 through 7.4.3.62, and Liferay DXP 7.4 update 21 through 62 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a user's (1) First Name, (2) Middle Name, (3) Last Name, or (4) Job Title text field.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00446 39th percentileScored 2026-11-07
Fix Fixed com.liferay.portal:release.portal.bom (Maven): 7.4.3.63

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
LiferayPortal7.4.3.21 – 7.4.3.62—No fix listedCNA
LiferayDXP7.4.13.u21 – 7.4.13.u62—No fix listedCNA
—com.liferay.portal:release.portal.bom (Maven)7.4.3.21 to before 7.4.3.637.4.3.63Patch availableGHSA-p9xg-9378-cqp7
  • Portal VendorLiferay Affected 7.4.3.21 – 7.4.3.62 Fixed in — No fix listed CNA
  • DXP VendorLiferay Affected 7.4.13.u21 – 7.4.13.u62 Fixed in — No fix listed CNA
  • com.liferay.portal:release.portal.bom (Maven) Vendor— Affected 7.4.3.21 to before 7.4.3.63 Fixed in 7.4.3.63 Patch available GHSA-p9xg-9378-cqp7

CPE configurations NVD · 43

CPEVersionsRoleVendor
cpe:2.3:a:liferay:digital_experience_platform:7.4:update21:*:*:*:*:*:*7.4 update21VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update22:*:*:*:*:*:*7.4 update22VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update23:*:*:*:*:*:*7.4 update23VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update24:*:*:*:*:*:*7.4 update24VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update25:*:*:*:*:*:*7.4 update25VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update26:*:*:*:*:*:*7.4 update26VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update27:*:*:*:*:*:*7.4 update27VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update28:*:*:*:*:*:*7.4 update28VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update29:*:*:*:*:*:*7.4 update29VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update30:*:*:*:*:*:*7.4 update30VulnerableLiferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update21:*:*:*:*:*:* Versions 7.4 update21 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update22:*:*:*:*:*:* Versions 7.4 update22 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update23:*:*:*:*:*:* Versions 7.4 update23 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update24:*:*:*:*:*:* Versions 7.4 update24 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update25:*:*:*:*:*:* Versions 7.4 update25 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update26:*:*:*:*:*:* Versions 7.4 update26 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update27:*:*:*:*:*:* Versions 7.4 update27 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update28:*:*:*:*:*:* Versions 7.4 update28 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update29:*:*:*:*:*:* Versions 7.4 update29 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update30:*:*:*:*:*:* Versions 7.4 update30 Vulnerable ·Liferay
Show 33 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:liferay:digital_experience_platform:7.4:update31:*:*:*:*:*:*7.4 update31VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update32:*:*:*:*:*:*7.4 update32VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update33:*:*:*:*:*:*7.4 update33VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update34:*:*:*:*:*:*7.4 update34VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update35:*:*:*:*:*:*7.4 update35VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update36:*:*:*:*:*:*7.4 update36VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update37:*:*:*:*:*:*7.4 update37VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update38:*:*:*:*:*:*7.4 update38VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update39:*:*:*:*:*:*7.4 update39VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update40:*:*:*:*:*:*7.4 update40VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update41:*:*:*:*:*:*7.4 update41VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update42:*:*:*:*:*:*7.4 update42VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update43:*:*:*:*:*:*7.4 update43VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update44:*:*:*:*:*:*7.4 update44VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update45:*:*:*:*:*:*7.4 update45VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update46:*:*:*:*:*:*7.4 update46VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update47:*:*:*:*:*:*7.4 update47VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update48:*:*:*:*:*:*7.4 update48VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update49:*:*:*:*:*:*7.4 update49VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update50:*:*:*:*:*:*7.4 update50VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update51:*:*:*:*:*:*7.4 update51VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update52:*:*:*:*:*:*7.4 update52VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update53:*:*:*:*:*:*7.4 update53VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update54:*:*:*:*:*:*7.4 update54VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update55:*:*:*:*:*:*7.4 update55VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update56:*:*:*:*:*:*7.4 update56VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update57:*:*:*:*:*:*7.4 update57VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update58:*:*:*:*:*:*7.4 update58VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update59:*:*:*:*:*:*7.4 update59VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update60:*:*:*:*:*:*7.4 update60VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update61:*:*:*:*:*:*7.4 update61VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update62:*:*:*:*:*:*7.4 update62VulnerableLiferay
cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*7.4.3.21 – 7.4.3.62VulnerableLiferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update31:*:*:*:*:*:* Versions 7.4 update31 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update32:*:*:*:*:*:* Versions 7.4 update32 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update33:*:*:*:*:*:* Versions 7.4 update33 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update34:*:*:*:*:*:* Versions 7.4 update34 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update35:*:*:*:*:*:* Versions 7.4 update35 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update36:*:*:*:*:*:* Versions 7.4 update36 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update37:*:*:*:*:*:* Versions 7.4 update37 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update38:*:*:*:*:*:* Versions 7.4 update38 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update39:*:*:*:*:*:* Versions 7.4 update39 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update40:*:*:*:*:*:* Versions 7.4 update40 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update41:*:*:*:*:*:* Versions 7.4 update41 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update42:*:*:*:*:*:* Versions 7.4 update42 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update43:*:*:*:*:*:* Versions 7.4 update43 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update44:*:*:*:*:*:* Versions 7.4 update44 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update45:*:*:*:*:*:* Versions 7.4 update45 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update46:*:*:*:*:*:* Versions 7.4 update46 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update47:*:*:*:*:*:* Versions 7.4 update47 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update48:*:*:*:*:*:* Versions 7.4 update48 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update49:*:*:*:*:*:* Versions 7.4 update49 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update50:*:*:*:*:*:* Versions 7.4 update50 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update51:*:*:*:*:*:* Versions 7.4 update51 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update52:*:*:*:*:*:* Versions 7.4 update52 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update53:*:*:*:*:*:* Versions 7.4 update53 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update54:*:*:*:*:*:* Versions 7.4 update54 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update55:*:*:*:*:*:* Versions 7.4 update55 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update56:*:*:*:*:*:* Versions 7.4 update56 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update57:*:*:*:*:*:* Versions 7.4 update57 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update58:*:*:*:*:*:* Versions 7.4 update58 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update59:*:*:*:*:*:* Versions 7.4 update59 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update60:*:*:*:*:*:* Versions 7.4 update60 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update61:*:*:*:*:*:* Versions 7.4 update61 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update62:*:*:*:*:*:* Versions 7.4 update62 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:* Versions 7.4.3.21 – 7.4.3.62 Vulnerable ·Liferay

Remediation

  • Fix · GHSA-p9xg-9378-cqp7 com.liferay.portal:release.portal.bom (Maven) Fixed in 7.4.3.63 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-33943
  2. 2026-10-03 Alias added: GHSA-p9xg-9378-cqp7

References

Advisory 2

Other 1

  • TI-2023-22732 Cross-site scripting in Liferay DXP CVSS 3.1CRITICAL 9.6
  • TI-2022-20403 A SQL injection vulnerability in the Layout module in Liferay Portal 7.1.3 through… CVSS 3.1HIGH 8.8
  • TI-2025-03097 Uncontrolled resource consumption in Liferay Portal CVSS 4.0HIGH 8.7
  • TI-2025-03169 Uncontrolled resource consumption in Liferay Portal CVSS 4.0HIGH 8.7
  • TI-2024-17354 Cross-site scripting in Liferay Portal CVSS 3.1CRITICAL 9.6
  • TI-2024-16598 Cross-site scripting in Liferay Portal CVSS 3.1CRITICAL 9.6
See all 263 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences