CVE-2023-42627

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Multiple stored cross-site scripting (XSS) vulnerabilities in the Commerce module in Liferay Portal 7.3.5 through 7.4.3.91, and Liferay DXP 7.3 update 33 and earlier, and 7.4 before update 92 allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a (1) Shipping Name, (2) Shipping Phone Number, (3) Shipping Address, (4) Shipping Address 2, (5) Shipping Address 3, (6) Shipping Zip, (7) Shipping City, (8) Shipping Region (9), Shipping Country, (10) Billing Name, (11) Billing Phone Number, (12) Billing Address, (13) Billing Address 2, (14) Billing Address 3, (15) Billing Zip, (16) Billing City, (17) Billing Region, (18) Billing Country, or (19) Region Code.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Oct 17, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-426285.4Stored cross-site scripting (XSS) vulnerability in the Wiki widget in Liferay Portal 7.1.0 through 7.4.3.87, and Liferay DXP 7.0 fix pack 83CVE-2023-426295.4Stored cross-site scripting (XSS) vulnerability in the manage vocabulary page in Liferay Portal 7.4.2 through 7.4.3.87, and Liferay DXP 7.4 CVE-2023-42638.8Potential buffer overflow vulnerability in the Zephyr IEEE 802.15.4 nRF 15.4 driverCVE-2023-426315.5In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional executiCVE-2023-426325.5In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional executiCVE-2023-426335.5In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional executiCVE-2023-426345.5In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional executiCVE-2023-426355.5In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional executiCVE-2023-426365.5In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional executiCVE-2023-426375.5In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional executiCVE-2023-426385.5In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional executiCVE-2023-426395.5In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional executi
CVE-2023-42627: Medium severity, CVSS 5.4 | Vulnix