CVE-2023-42628

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Stored cross-site scripting (XSS) vulnerability in the Wiki widget in Liferay Portal 7.1.0 through 7.4.3.87, and Liferay DXP 7.0 fix pack 83 through 102, 7.1 fix pack 28 and earlier, 7.2 fix pack 20 and earlier, 7.3 update 33 and earlier, and 7.4 before update 88 allows remote attackers to inject arbitrary web script or HTML into a parent wiki page via a crafted payload injected into a wiki page's ‘Content’ text field.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Oct 17, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-426295.4Stored cross-site scripting (XSS) vulnerability in the manage vocabulary page in Liferay Portal 7.4.2 through 7.4.3.87, and Liferay DXP 7.4 CVE-2023-42638.8Potential buffer overflow vulnerability in the Zephyr IEEE 802.15.4 nRF 15.4 driverCVE-2023-426315.5In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional executiCVE-2023-426325.5In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional executiCVE-2023-426335.5In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional executiCVE-2023-426345.5In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional executiCVE-2023-426355.5In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional executiCVE-2023-426365.5In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional executiCVE-2023-426375.5In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional executiCVE-2023-426385.5In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional executiCVE-2023-426395.5In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional executiCVE-2023-42649.6Potential buffer overflow vulnerabilities n the Zephyr Bluetooth subsystem.
CVE-2023-42628: Medium severity, CVSS 5.4 | Vulnix