Cross-site scripting in Liferay DXP
Priority MEDIUM 48CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
Multiple stored cross-site scripting (XSS) vulnerabilities in the Commerce module in Liferay Portal 7.3.5 through 7.4.3.91, and Liferay DXP 7.3 update 33 and earlier, and 7.4 before update 92 allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a (1) Shipping Name, (2) Shipping Phone Number, (3) Shipping Address, (4) Shipping Address 2, (5) Shipping Address 3, (6) Shipping Zip, (7) Shipping City, (8) Shipping Region (9), Shipping Country, (10) Billing Name, (11) Billing Phone Number, (12) Billing Address, (13) Billing Address 2, (14) Billing Address 3, (15) Billing Zip, (16) Billing City, (17) Billing Region, (18) Billing Country, or (19) Region Code.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02785 86th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix Fixed com.liferay.commerce:com.liferay.commerce.address.content.web (Maven): 4.0.35
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Liferay | DXP | 7.3.10 and later; 7.4.13 – 7.4.13.u91 | — | No fix listed | CNA |
| Liferay | Portal | 7.3.5 – 7.4.3.91 | — | No fix listed | CNA |
| — | com.liferay.commerce:com.liferay.commerce.address.content.web (Maven) | before 4.0.35 | 4.0.35 | Patch available | GHSA-qp68-5v39-r869 |
| — | com.liferay.portal:release.dxp.bom (Maven) | 7.3.0 – 7.3.10.u33 | — | No fix listed | GHSA-qp68-5v39-r869 |
| — | com.liferay.portal:release.dxp.bom (Maven) | 7.4.0 – 7.4.13.u92 | — | No fix listed | GHSA-qp68-5v39-r869 |
- DXP VendorLiferay Affected 7.3.10 and later; 7.4.13 – 7.4.13.u91 Fixed in — No fix listed CNA
- Portal VendorLiferay Affected 7.3.5 – 7.4.3.91 Fixed in — No fix listed CNA
- com.liferay.commerce:com.liferay.commerce.address.content.web (Maven) Vendor— Affected before 4.0.35 Fixed in 4.0.35 Patch available GHSA-qp68-5v39-r869
- com.liferay.portal:release.dxp.bom (Maven) Vendor— Affected 7.3.0 – 7.3.10.u33 Fixed in — No fix listed GHSA-qp68-5v39-r869
- com.liferay.portal:release.dxp.bom (Maven) Vendor— Affected 7.4.0 – 7.4.13.u92 Fixed in — No fix listed GHSA-qp68-5v39-r869
CPE configurations NVD · 23
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:liferay:digital_experience_platform:7.3:-:*:*:*:*:*:* | 7.3 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.3:fix_pack_1:*:*:*:*:*:* | 7.3 fix_pack_1 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.3:fix_pack_2:*:*:*:*:*:* | 7.3 fix_pack_2 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.3:update14:*:*:*:*:*:* | 7.3 update14 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.4:-:*:*:*:*:*:* | 7.4 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.4:update1:*:*:*:*:*:* | 7.4 update1 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.4:update21:*:*:*:*:*:* | 7.4 update21 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.4:update34:*:*:*:*:*:* | 7.4 update34 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.4:update36:*:*:*:*:*:* | 7.4 update36 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.4:update41:*:*:*:*:*:* | 7.4 update41 | Vulnerable | Liferay |
- cpe:2.3:a:liferay:digital_experience_platform:7.3:-:*:*:*:*:*:* Versions 7.3 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.3:fix_pack_1:*:*:*:*:*:* Versions 7.3 fix_pack_1 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.3:fix_pack_2:*:*:*:*:*:* Versions 7.3 fix_pack_2 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.3:update14:*:*:*:*:*:* Versions 7.3 update14 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.4:-:*:*:*:*:*:* Versions 7.4 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update1:*:*:*:*:*:* Versions 7.4 update1 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update21:*:*:*:*:*:* Versions 7.4 update21 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update34:*:*:*:*:*:* Versions 7.4 update34 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update36:*:*:*:*:*:* Versions 7.4 update36 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update41:*:*:*:*:*:* Versions 7.4 update41 Vulnerable ·Liferay
Show 13 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:liferay:digital_experience_platform:7.4:update48:*:*:*:*:*:* | 7.4 update48 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.4:update50:*:*:*:*:*:* | 7.4 update50 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.4:update52:*:*:*:*:*:* | 7.4 update52 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.4:update62:*:*:*:*:*:* | 7.4 update62 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.4:update67:*:*:*:*:*:* | 7.4 update67 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.4:update76:*:*:*:*:*:* | 7.4 update76 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.4:update81:*:*:*:*:*:* | 7.4 update81 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.4:update82:*:*:*:*:*:* | 7.4 update82 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.4:update83:*:*:*:*:*:* | 7.4 update83 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.4:update84:*:*:*:*:*:* | 7.4 update84 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.4:update85:*:*:*:*:*:* | 7.4 update85 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.4:update86:*:*:*:*:*:* | 7.4 update86 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:* | 7.3.5 to before 7.4.3.92 | Vulnerable | Liferay |
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update48:*:*:*:*:*:* Versions 7.4 update48 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update50:*:*:*:*:*:* Versions 7.4 update50 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update52:*:*:*:*:*:* Versions 7.4 update52 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update62:*:*:*:*:*:* Versions 7.4 update62 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update67:*:*:*:*:*:* Versions 7.4 update67 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update76:*:*:*:*:*:* Versions 7.4 update76 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update81:*:*:*:*:*:* Versions 7.4 update81 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update82:*:*:*:*:*:* Versions 7.4 update82 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update83:*:*:*:*:*:* Versions 7.4 update83 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update84:*:*:*:*:*:* Versions 7.4 update84 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update85:*:*:*:*:*:* Versions 7.4 update85 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update86:*:*:*:*:*:* Versions 7.4 update86 Vulnerable ·Liferay
- cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:* Versions 7.3.5 to before 7.4.3.92 Vulnerable ·Liferay
Remediation
- Fix · GHSA-qp68-5v39-r869 com.liferay.commerce:com.liferay.commerce.address.content.web (Maven) Fixed in 4.0.35 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2023-42627
- 2026-10-03 Alias added: GHSA-qp68-5v39-r869
References
Exploit 1
Advisory 2
More Liferay Digital Experience Platform vulnerabilities
- TI-2022-20403 A SQL injection vulnerability in the Layout module in Liferay Portal 7.1.3 through… CVSS 3.1HIGH 8.8
- TI-2025-03097 Uncontrolled resource consumption in Liferay Portal CVSS 4.0HIGH 8.7
- TI-2025-03169 Uncontrolled resource consumption in Liferay Portal CVSS 4.0HIGH 8.7
- TI-2024-17354 Cross-site scripting in Liferay Portal CVSS 3.1CRITICAL 9.6
- TI-2024-16598 Cross-site scripting in Liferay Portal CVSS 3.1CRITICAL 9.6
- TI-2024-16596 Cross-site scripting in Liferay Portal CVSS 3.1CRITICAL 9.6
Sources
- CVE-2023-42627 · CVE Program
- CVE-2023-42627 · NVD
- FIRST EPSS
- GHSA-qp68-5v39-r869 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences