CVE-2023-47797

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Reflected cross-site scripting (XSS) vulnerability on a content page’s edit page in Liferay Portal 7.4.3.94 through 7.4.3.95 allows remote attackers to inject arbitrary web script or HTML via the `p_l_back_url_title` parameter.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Liferay	Portal	>= 7.4.3.94, <= 7.4.3.95

References

Timeline

Published: Nov 17, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-477984.6Account lockout in Liferay Portal 7.2.0 through 7.3.0, and older unsupported versions, and Liferay DXP 7.2 before fix pack 5, and older unsu CVE-2023-477997.5Mahara before 22.10.4 and 23.x before 23.04.4 allows information disclosure if the experimental HTML bulk export is used via the administrat CVE-2023-478009.8Natus NeuroWorks and SleepWorks before 8.4 GMA3 utilize a default password of xltek for the Microsoft SQL Server service sa account, allowin CVE-2023-478014.7An issue was discovered in Click Studios Passwordstate before 9811. Existing users (Security Administrators) could use the System Wide API K CVE-2023-478027.2A vulnerability regarding improper neutralization of special elements used in an OS command ('OS Command Injection') is found in the IP bloc CVE-2023-478035.3A vulnerability regarding improper limitation of a pathname to a restricted directory ('Path Traversal') is found in the Language Settings f CVE-2023-478048.8Apache OpenOffice documents can contain links that call internal macros with arbitrary arguments. Several URI Schemes are defined for this p CVE-2023-478059.8Missing Authorization vulnerability in Arraytics WPCafe wp-cafe allows Exploiting Incorrectly Configured Access Control Security Levels.This CVE-2023-478068.8Cross-Site Request Forgery (CSRF) vulnerability in Saint Systems Disable User Login.This issue affects Disable User Login: from n/a through CVE-2023-478074.3Missing Authorization vulnerability in 10Web 10WebAnalytics wd-google-analytics allows Exploiting Incorrectly Configured Access Control Secu CVE-2023-478085.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Christina Uechi Add Widgets to Page pl CVE-2023-478095.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themepoints Accordion plugin <= 2.6 ve