CVE-2023-42498

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-02-21 · updated 2026-06-17
Weakness: CWE-79

Description

Reflected cross-site scripting (XSS) vulnerability in the Language Override edit screen in Liferay Portal 7.4.3.8 through 7.4.3.97, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 4 through 92 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_portal_language_override_web_internal_portlet_PLOPortlet_key parameter.

Affected products

Liferay Digital Experience Platform: 7.4-update10, 7.4-update11, 7.4-update12, 7.4-update13, 7.4-update14, 7.4-update15 (+88)
Liferay Portal: from 7.4.3.8 before 7.4.3.98 — fixed in 7.4.3.98

How to fix

Upgrade to a fixed version: Liferay Portal 7.4.3.98. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-42498 or the next vulnerability affects your stack