CVE-2023-42496

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Reflected cross-site scripting (XSS) vulnerability on the add assignees to a role page in Liferay Portal 7.3.3 through 7.4.3.97, and Liferay DXP 2023.Q3 before patch 6, 7.4 GA through update 92, and 7.3 before update 34 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_roles_admin_web_portlet_RolesAdminPortlet_tabs2 parameter.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Feb 21, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-424976.1Reflected cross-site scripting (XSS) vulnerability on the Export for Translation page in Liferay Portal 7.4.3.4 through 7.4.3.85, and Lifera CVE-2023-424986.1Reflected cross-site scripting (XSS) vulnerability in the Language Override edit screen in Liferay Portal 7.4.3.8 through 7.4.3.97, and Life CVE-2023-42506.1The EventPrime WordPress plugin before 3.2.0 does not sanitise and escape some parameters before outputting them back in the page, leading t CVE-2023-425014.3Unnecessary read permissions within the Gamma role would allow authenticated users to read configured CSS templates and annotations. This is CVE-2023-425025.4An authenticated attacker with update datasets permission could change a dataset link to an untrusted site by spoofing the HTTP Host header,CVE-2023-425035.5Improper Input Validation, Uncontrolled Resource Consumption vulnerability in Apache Commons Compress in TAR parsing.This issue affects Apac CVE-2023-425046.5An authenticated malicious user could initiate multiple concurrent requests, each requesting multiple dashboard exports, leading to a possib CVE-2023-425054.3An authenticated user with read permissions on database connections metadata could potentially access sensitive information such as the conn CVE-2023-425067.8Improper restriction of operations within the bounds of a memory buffer issue exists in OnSinView2 versions 2.0.1 and earlier. If this vulne CVE-2023-425077.8Stack-based buffer overflow vulnerability exists in OnSinView2 versions 2.0.1 and earlier. If this vulnerability is exploited, information m CVE-2023-425086.5JFrog Artifactory prior to version 7.66.0 is vulnerable to specific endpoint abuse with a specially crafted payload, which can lead to unaut CVE-2023-425097.5JFrog Artifactory later than version 7.17.4 but prior to version 7.77.0 is vulnerable to an issue whereby a sequence of improperly handled e