CVE-2023-42497

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Reflected cross-site scripting (XSS) vulnerability on the Export for Translation page in Liferay Portal 7.4.3.4 through 7.4.3.85, and Liferay DXP 7.4 before update 86 allows remote attackers to inject arbitrary web script or HTML via the `_com_liferay_translation_web_internal_portlet_TranslationPortlet_redirect` parameter.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Oct 17, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-424986.1Reflected cross-site scripting (XSS) vulnerability in the Language Override edit screen in Liferay Portal 7.4.3.8 through 7.4.3.97, and LifeCVE-2023-42506.1The EventPrime WordPress plugin before 3.2.0 does not sanitise and escape some parameters before outputting them back in the page, leading tCVE-2023-425014.3Unnecessary read permissions within the Gamma role would allow authenticated users to read configured CSS templates and annotations. This isCVE-2023-425025.4An authenticated attacker with update datasets permission could change a dataset link to an untrusted site by spoofing the HTTP Host header,CVE-2023-425035.5Improper Input Validation, Uncontrolled Resource Consumption vulnerability in Apache Commons Compress in TAR parsing.This issue affects ApacCVE-2023-425046.5An authenticated malicious user could initiate multiple concurrent requests, each requesting multiple dashboard exports, leading to a possibCVE-2023-425054.3An authenticated user with read permissions on database connections metadata could potentially access sensitive information such as the connCVE-2023-425067.8Improper restriction of operations within the bounds of a memory buffer issue exists in OnSinView2 versions 2.0.1 and earlier. If this vulneCVE-2023-425077.8Stack-based buffer overflow vulnerability exists in OnSinView2 versions 2.0.1 and earlier. If this vulnerability is exploited, information mCVE-2023-425086.5JFrog Artifactory prior to version 7.66.0 is vulnerable to specific endpoint abuse with a specially crafted payload, which can lead to unautCVE-2023-425097.5JFrog Artifactory later than version 7.17.4 but prior to version 7.77.0 is vulnerable to an issue whereby a sequence of improperly handled eCVE-2023-42514.3The EventPrime WordPress plugin before 3.2.0 does not have CSRF checks when creating bookings, which could allow attackers to make logged in