CVE-2023-47795

An attacker with an account in the system injects a malicious payload (JavaScript or HTML code) into the 'Title' field when adding or editing a document in the Document and Media widget. The malicious code is permanently saved in the platform's database (hence the 'stored' classification). Every user who views the infected document in a browser unknowingly executes the malicious script in the context of the Liferay website. The vulnerability has cross-context scope (Scope: Changed), which means it can affect resources beyond the attacker's direct environment.

An attacker can hijack sessions of other users (including administrators), gain access to sensitive data, modify portal content, or perform unauthorized actions on behalf of the victim. In case of an attack on an administrator account, complete takeover of the platform instance is possible.

Liferay Portal should be updated to a version higher than 7.4.3.101, and Liferay DXP 2023.Q3 to patch 6 or newer, and Liferay DXP 7.4 to update 93 or newer. Detailed information about available patches is available in the vendor's references at: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-47795

Liferay Portal in versions 7.4.3.18 – 7.4.3.101 and Liferay DXP 2023.Q3 before patch 6, as well as Liferay DXP 7.4 update 18 – 92.