| Package | Affected versions | Patched versions |
|---|---|---|
| com.liferay:com.liferay.portal.search | < 8.0.93 | 8.0.93 |
| digital experience platform | = 2023.q3.0= 2023.q3.1= 2023.q3.2= 2023.q3.3= 2023.q3.4= 2023.q4.0= 2023.q4.1 | |
| liferay portal | ≥ 7.4.3.93, < 7.4.3.112 | 7.4.3.112 |
There is a Cross-site scripting (XSS) vulnerability in Liferay Portal's Search widget . Versions 7.4.3.93 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4 allow remote attackers to inject arbitrary web scripts or HTML via the _com_liferay_portal_search_web_portlet_SearchPortlet_userId parameter.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free