CVE-2023-42629

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Stored cross-site scripting (XSS) vulnerability in the manage vocabulary page in Liferay Portal 7.4.2 through 7.4.3.87, and Liferay DXP 7.4 before update 88 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a Vocabulary's 'description' text field.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
LiferayDXP>= 7.4.13, <= 7.4.13.u87
LiferayPortal>= 7.4.2, <= 7.4.3.87

References

Timeline

Published
Oct 17, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-42638.8Potential buffer overflow vulnerability in the Zephyr IEEE 802.15.4 nRF 15.4 driverCVE-2023-426315.5In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional executiCVE-2023-426325.5In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional executiCVE-2023-426335.5In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional executiCVE-2023-426345.5In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional executiCVE-2023-426355.5In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional executiCVE-2023-426365.5In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional executiCVE-2023-426375.5In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional executiCVE-2023-426385.5In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional executiCVE-2023-426395.5In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional executiCVE-2023-42649.6Potential buffer overflow vulnerabilities n the Zephyr Bluetooth subsystem.CVE-2023-426405.5In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional executi
CVE-2023-42629: Medium severity, CVSS 5.4 | Vulnix