| Package | Affected versions | Patched versions |
|---|---|---|
| com.liferay.commerce:com.liferay.commerce.order.web | ≥ 5.0.29, < 5.0.101 | 5.0.101 |
| digital experience platform | = 7.4≥ 2023.q3.1, < 2023.q3.9≥ 2023.q4.0, < 2023.q4.6 | 2023.q3.92023.q4.6 |
| liferay portal | ≥ 7.4.3.8, < 7.4.3.112 | 7.4.3.112 |
Stored cross-site scripting (XSS) vulnerability in Commerce’s view order page in Liferay Portal 7.4.3.8 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 8 through update 92 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into an Account’s “Name” text field.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free