CVE-2023-44309 json
Liferay Portal and Liferay DXP Vulnerable to XSS in the Fragment Components
published 2023-10-17 3 y ago modified 2026-06-17 4 mo ago also BIT-liferay-2023-44309 , EUVD-2023-48665 , GHSA-j663-6jpj-xx8c
- cvss
- 9.0
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 47%
- public exploits
- 0
- none known
Summary
Multiple stored cross-site scripting (XSS) vulnerabilities in the fragment components in Liferay Portal 7.4.2 through 7.4.3.53, and Liferay DXP 7.4 before update 54 allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into any non-HTML field of a linked source asset.
Patch / fix
- maven com.liferay:com.liferay.fragment.entry.processor.impl 3.0.25
- maven com.liferay.portal:release.dxp.bom 7.4.13.u54
- liferay liferay_portal 7.4.3.53
- github.com/liferay/liferay-portal@1287c68 commit
- github.com/liferay/liferay-portal@28f8a7a commit
- github.com/liferay/liferay-portal@9031a7a commit
- github.com/liferay/liferay-portal@ba62873 commit
- github.com/liferay/liferay-portal@d70fecd commit
- github.com/liferay/liferay-portal@e45bf2d commit
- github.com/liferay/liferay-portal@ed856dd commit
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.57% chance of exploitation in the next 30 days, higher than 47% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.0 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H |
| GitHub | 3.1 | 9.0 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H |
| NVD | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
| OSV | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | com.liferay:com.liferay.fragment.entry.processor.impl | <3.0.25 |
3.0.25 |
| maven | com.liferay.portal:release.dxp.bom | >=7.4.0, <7.4.13.u54 |
7.4.13.u54 |
| bitnami | liferay | >=7.4.0, <=7.4.0 >=7.4-update1.0, <=7.4-update1.0 >=7.4-update21.0, <=7.4-update21.0 >=7.4-update34.0, <=7.4-update34.0 >=7.4-update36.0, <=7.4-update36.0 >=7.4-update41.0, <=7.4-update41.0 >=7.4-update48.0, <=7.4-update48.0 >=7.4-update50.0, <=7.4-update50.0 >=7.4-update52.0, <=7.4-update52.0 |
no fix listed |
Affected products
- Liferay DXP
- Liferay Portal
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/liferay/liferay-portal/commit/1287c68486d60b87179995d8b8bd530031300a47
web
-
github.com
/liferay/liferay-portal/commit/28f8a7aabccce45e9d60cfb0cf63fc53c99b0d26
web
-
github.com
/liferay/liferay-portal/commit/9031a7a03e5891e7ccf762011fe8bcc2e433b1db
web
-
github.com
/liferay/liferay-portal/commit/ba628735cfae8656ab4243ecffce260413ed2460
web
-
github.com
/liferay/liferay-portal/commit/d70fecd2c5709d8dd5f4992b408a640ce912001b
web
-
github.com
/liferay/liferay-portal/commit/e45bf2d00ed7f95f02702a1da3e4115ab30b1bff
web
-
github.com
/liferay/liferay-portal/commit/ed856dd9e2947e3e660d7cfbdb8c604b296db790
web
-
liferay.dev
/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-44309
vendor-advisory, web
-
nvd.nist.gov
/vuln/detail/CVE-2023-44309
advisory
-
github.com
/liferay/liferay-portal
package
Sources
- CVE List CVE-2023-44309
- GitHub Advisory GHSA-j663-6jpj-xx8c
- NVD CVE-2023-44309
- OSV BIT-liferay-2023-44309
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.