CVE-2023-37940 (GCVE-0-2023-37940)
Vulnerability from cvelistv5 – Published: 2024-12-17 21:30 – Updated: 2024-12-17 21:41
VLAI?
Summary
Cross-site scripting (XSS) vulnerability in the edit Service Access Policy page in Liferay Portal 7.0.0 through 7.4.3.87, and Liferay DXP 7.4 GA through update 87, 7.3 GA through update 29, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a service access policy's `Service Class` text field.
Severity ?
4.8 (Medium)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Assigner
References
Impacted products
Credits
milCERT AT
Abderrahmane BOUNHIDJA
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-37940",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-17T21:41:20.332148Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-12-17T21:41:38.543Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Portal",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.4.3.87",
"status": "affected",
"version": "7.0.0",
"versionType": "maven"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DXP",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "de-102",
"status": "affected",
"version": "7.0.10",
"versionType": "maven"
},
{
"lessThanOrEqual": "dxp-28",
"status": "affected",
"version": "7.1.10",
"versionType": "maven"
},
{
"lessThanOrEqual": "dxp-20",
"status": "affected",
"version": "7.2.10",
"versionType": "maven"
},
{
"lessThanOrEqual": "7.3.10-u29",
"status": "affected",
"version": "7.3.10",
"versionType": "maven"
},
{
"lessThanOrEqual": "7.4.13-u87",
"status": "affected",
"version": "7.4.13",
"versionType": "maven"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "milCERT AT"
},
{
"lang": "en",
"type": "reporter",
"value": "Abderrahmane BOUNHIDJA"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Cross-site scripting (XSS) vulnerability in the edit Service Access Policy page in Liferay Portal 7.0.0 through 7.4.3.87, and Liferay DXP 7.4 GA through update 87, 7.3 GA through update 29, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a service access policy\u0027s `Service Class` text field."
}
],
"value": "Cross-site scripting (XSS) vulnerability in the edit Service Access Policy page in Liferay Portal 7.0.0 through 7.4.3.87, and Liferay DXP 7.4 GA through update 87, 7.3 GA through update 29, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a service access policy\u0027s `Service Class` text field."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-12-17T21:30:39.730Z",
"orgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"shortName": "Liferay"
},
"references": [
{
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2023-37940"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"assignerShortName": "Liferay",
"cveId": "CVE-2023-37940",
"datePublished": "2024-12-17T21:30:39.730Z",
"dateReserved": "2023-07-11T09:17:17.552Z",
"dateUpdated": "2024-12-17T21:41:38.543Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"fkie_nvd": {
"descriptions": "[{\"lang\": \"en\", \"value\": \"Cross-site scripting (XSS) vulnerability in the edit Service Access Policy page in Liferay Portal 7.0.0 through 7.4.3.87, and Liferay DXP 7.4 GA through update 87, 7.3 GA through update 29, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a service access policy\u0027s `Service Class` text field.\"}, {\"lang\": \"es\", \"value\": \"Una vulnerabilidad de cross-site scripting (XSS) en Service Access Policy page en Liferay Portal 7.0.0 a 7.4.3.87, y Liferay DXP 7.4 GA a la actualizaci\\u00f3n 87, 7.3 GA a la actualizaci\\u00f3n 29 y versiones anteriores no compatibles permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a trav\\u00e9s de un payload manipulado inyectado en el campo de texto \\\"Clase de servicio\\\" de una pol\\u00edtica de acceso al servicio.\"}]",
"id": "CVE-2023-37940",
"lastModified": "2024-12-17T22:15:05.080",
"metrics": "{\"cvssMetricV31\": [{\"source\": \"security@liferay.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N\", \"baseScore\": 4.8, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"HIGH\", \"userInteraction\": \"REQUIRED\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"LOW\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 1.7, \"impactScore\": 2.7}]}",
"published": "2024-12-17T22:15:05.080",
"references": "[{\"url\": \"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2023-37940\", \"source\": \"security@liferay.com\"}]",
"sourceIdentifier": "security@liferay.com",
"vulnStatus": "Awaiting Analysis",
"weaknesses": "[{\"source\": \"security@liferay.com\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-79\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2023-37940\",\"sourceIdentifier\":\"security@liferay.com\",\"published\":\"2024-12-17T22:15:05.080\",\"lastModified\":\"2025-01-28T21:18:48.497\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Cross-site scripting (XSS) vulnerability in the edit Service Access Policy page in Liferay Portal 7.0.0 through 7.4.3.87, and Liferay DXP 7.4 GA through update 87, 7.3 GA through update 29, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a service access policy\u0027s `Service Class` text field.\"},{\"lang\":\"es\",\"value\":\"Una vulnerabilidad de cross-site scripting (XSS) en Service Access Policy page en Liferay Portal 7.0.0 a 7.4.3.87, y Liferay DXP 7.4 GA a la actualizaci\u00f3n 87, 7.3 GA a la actualizaci\u00f3n 29 y versiones anteriores no compatibles permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a trav\u00e9s de un payload manipulado inyectado en el campo de texto \\\"Clase de servicio\\\" de una pol\u00edtica de acceso al servicio.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security@liferay.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N\",\"baseScore\":4.8,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.7,\"impactScore\":2.7},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N\",\"baseScore\":4.8,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.7,\"impactScore\":2.7}]},\"weaknesses\":[{\"source\":\"security@liferay.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"7.0.0\",\"versionEndExcluding\":\"7.4.3.88\",\"matchCriteriaId\":\"BB292A92-C12B-486D-B4EE-421BFFD636AF\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"7.0\",\"versionEndExcluding\":\"7.3\",\"matchCriteriaId\":\"7F20477F-7F50-40D8-8DB2-251B4BC74207\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.3:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"6F6A98ED-E694-4F39-95D0-C152BD1EC115\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.3:fix_pack_1:*:*:*:*:*:*\",\"matchCriteriaId\":\"2CD6861A-D546-462F-8B22-FA76A4AF8A9C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.3:fix_pack_2:*:*:*:*:*:*\",\"matchCriteriaId\":\"324BB977-5AAC-4367-98FC-605FF4997B3F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.3:service_pack_1:*:*:*:*:*:*\",\"matchCriteriaId\":\"2BBA40AC-4619-434B-90CF-4D29A1CA6D86\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.3:service_pack_3:*:*:*:*:*:*\",\"matchCriteriaId\":\"728DF154-F19F-454C-87CA-1E755107F2A6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.3:update10:*:*:*:*:*:*\",\"matchCriteriaId\":\"AA984F92-4C6C-4049-A731-96F587B51E75\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.3:update11:*:*:*:*:*:*\",\"matchCriteriaId\":\"CADDF499-DDC4-4CEE-B512-404EA2024FCB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.3:update12:*:*:*:*:*:*\",\"matchCriteriaId\":\"9EC64246-1039-4009-B9BD-7828FA0FA1C5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.3:update13:*:*:*:*:*:*\",\"matchCriteriaId\":\"D9F352AE-AE22-4A84-94B6-6621D7E0BC59\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.3:update14:*:*:*:*:*:*\",\"matchCriteriaId\":\"3E84D881-6D47-48FD-B743-9D531F5F7D5C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.3:update15:*:*:*:*:*:*\",\"matchCriteriaId\":\"1F8A9DEC-2C27-4EBB-B684-8EBDB374CFCC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.3:update16:*:*:*:*:*:*\",\"matchCriteriaId\":\"C3E7B777-8026-4C8F-9353-B5504873E0F8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.3:update17:*:*:*:*:*:*\",\"matchCriteriaId\":\"2207FEE5-2537-4C6E-AC9C-EC53DBF3C57E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.3:update18:*:*:*:*:*:*\",\"matchCriteriaId\":\"087A2B43-07CE-4B3D-B879-449631DDA8D7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.3:update19:*:*:*:*:*:*\",\"matchCriteriaId\":\"019CED83-6277-434C-839C-6C4E0C45FB1A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.3:update20:*:*:*:*:*:*\",\"matchCriteriaId\":\"6C533124-74E6-4312-9AF7-6496DE2A5152\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.3:update21:*:*:*:*:*:*\",\"matchCriteriaId\":\"8DDA248D-5F00-4FC1-B857-A7942BAA1F3E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.3:update22:*:*:*:*:*:*\",\"matchCriteriaId\":\"6C6BA174-69D4-43FC-9395-1B6306A44CDC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.3:update23:*:*:*:*:*:*\",\"matchCriteriaId\":\"A465C229-D3FB-43E9-87BE-119BEE9110F0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.3:update24:*:*:*:*:*:*\",\"matchCriteriaId\":\"32E98546-CE96-4BB8-A11C-F7E850C155F3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.3:update25:*:*:*:*:*:*\",\"matchCriteriaId\":\"DD43C626-F2F2-43BA-85AA-6ADAE8A6D11F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.3:update26:*:*:*:*:*:*\",\"matchCriteriaId\":\"5C72C0E0-7D0B-4E8F-A109-7BB5DCA1C8D1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.3:update27:*:*:*:*:*:*\",\"matchCriteriaId\":\"7E796B04-FF54-4C02-979C-87E137A76F63\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.3:update28:*:*:*:*:*:*\",\"matchCriteriaId\":\"07C3D771-5E1B-46C4-AAF8-F425377582D2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.3:update29:*:*:*:*:*:*\",\"matchCriteriaId\":\"B08F95DC-BE49-4717-B959-2BE8BD131953\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.3:update4:*:*:*:*:*:*\",\"matchCriteriaId\":\"AD408C73-7D78-4EB1-AA2C-F4A6D4DC980B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.3:update5:*:*:*:*:*:*\",\"matchCriteriaId\":\"513F3229-7C31-44EB-88F6-E564BE725853\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.3:update6:*:*:*:*:*:*\",\"matchCriteriaId\":\"76B9CD05-A10E-439C-9FDE-EA88EC3AF2C6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.3:update7:*:*:*:*:*:*\",\"matchCriteriaId\":\"A7D2D415-36AA-41B2-8FD9-21A98CDFE1EF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.3:update8:*:*:*:*:*:*\",\"matchCriteriaId\":\"124F2D2E-F8E7-4EDE-A98B-DD72FB43DF20\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.3:update9:*:*:*:*:*:*\",\"matchCriteriaId\":\"0DEE5985-289E-4138-B7C0-1E471BA7A1FD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"96E84DBC-C740-4E23-8D1D-83C8AE49813E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update1:*:*:*:*:*:*\",\"matchCriteriaId\":\"8B1B2384-764F-43CC-8206-36DCBE9DDCBF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update10:*:*:*:*:*:*\",\"matchCriteriaId\":\"C7B02106-D5EA-4A59-A959-CCE2AC8F55BC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update11:*:*:*:*:*:*\",\"matchCriteriaId\":\"80204464-5DC5-4A52-B844-C833A96E6BD4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update12:*:*:*:*:*:*\",\"matchCriteriaId\":\"6F8A5D02-0B45-4DA9-ACD8-42C1BFF62827\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update13:*:*:*:*:*:*\",\"matchCriteriaId\":\"38DA7C99-AC2C-4B9A-B611-4697159E1D79\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update14:*:*:*:*:*:*\",\"matchCriteriaId\":\"F264AD07-D105-4F00-8920-6D8146E4FA63\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update15:*:*:*:*:*:*\",\"matchCriteriaId\":\"C929CF16-4725-492A-872B-0928FE388FC9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update16:*:*:*:*:*:*\",\"matchCriteriaId\":\"1B8750A1-E481-48D4-84F4-97D1ABE15B46\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update17:*:*:*:*:*:*\",\"matchCriteriaId\":\"454F8410-D9AC-481E-841C-60F0DF2CC25E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update18:*:*:*:*:*:*\",\"matchCriteriaId\":\"D1A442EE-460F-4823-B9EF-4421050F0847\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update19:*:*:*:*:*:*\",\"matchCriteriaId\":\"608B205D-0B79-4D1C-B2C1-64C31DB1896E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update2:*:*:*:*:*:*\",\"matchCriteriaId\":\"10B863B8-201D-494C-8175-168820996174\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update20:*:*:*:*:*:*\",\"matchCriteriaId\":\"4427DC78-E80C-4057-A295-B0731437A99E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update21:*:*:*:*:*:*\",\"matchCriteriaId\":\"22B6B8C1-1FF3-41BC-9576-16193AE20CC7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update22:*:*:*:*:*:*\",\"matchCriteriaId\":\"DDA17F24-1A7E-4BEB-9C98-41761A2A36A2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update23:*:*:*:*:*:*\",\"matchCriteriaId\":\"3B062851-CE6B-44F4-8222-422EC9872EC3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update24:*:*:*:*:*:*\",\"matchCriteriaId\":\"D4687FDA-0078-4E89-ADD8-7EDDA68261A4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update25:*:*:*:*:*:*\",\"matchCriteriaId\":\"7EA29B09-CC24-4063-96A5-96AA08C0886D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update26:*:*:*:*:*:*\",\"matchCriteriaId\":\"331FC246-D3E9-4711-B305-BE51BF743CF7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update27:*:*:*:*:*:*\",\"matchCriteriaId\":\"A5823BC0-8C11-4C31-9E99-3C9D82918E2A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update28:*:*:*:*:*:*\",\"matchCriteriaId\":\"E2E6CB66-1AE1-4626-8070-64C250ED8363\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update29:*:*:*:*:*:*\",\"matchCriteriaId\":\"B63449AA-6831-4290-B1FA-0BB806820402\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update3:*:*:*:*:*:*\",\"matchCriteriaId\":\"CBF766CE-CBB8-472A-BAF0-BD39A7BCB4DE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update30:*:*:*:*:*:*\",\"matchCriteriaId\":\"B3B169F6-B8B8-4612-AD7D-F75CC6A9297B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update31:*:*:*:*:*:*\",\"matchCriteriaId\":\"12D46756-D26D-4877-ACE8-1C2721908428\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update32:*:*:*:*:*:*\",\"matchCriteriaId\":\"5403DCEF-20C2-4568-8DF1-30804F522915\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update33:*:*:*:*:*:*\",\"matchCriteriaId\":\"90E39742-90BE-4DEB-AB78-F9B8F7333F9A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update34:*:*:*:*:*:*\",\"matchCriteriaId\":\"9D07DB20-9DCF-4C05-99D2-F6B37A082C14\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update35:*:*:*:*:*:*\",\"matchCriteriaId\":\"341D1157-8118-4BD3-A902-36E90E066706\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update36:*:*:*:*:*:*\",\"matchCriteriaId\":\"1AB71307-7EAA-436A-9CBC-5A94F034FB48\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update37:*:*:*:*:*:*\",\"matchCriteriaId\":\"9446B3A5-6647-416C-92AF-7B6E0E929765\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update38:*:*:*:*:*:*\",\"matchCriteriaId\":\"06386C7A-CAA1-4FC4-9182-5A66342FB903\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update39:*:*:*:*:*:*\",\"matchCriteriaId\":\"8C84B701-B9A1-43D0-AF0C-30EDBD24CF90\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update4:*:*:*:*:*:*\",\"matchCriteriaId\":\"182FAA46-D9FB-4170-B305-BAD0DF6E5DE9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update40:*:*:*:*:*:*\",\"matchCriteriaId\":\"BA9AF651-D118-4437-B400-531B26BF6801\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update41:*:*:*:*:*:*\",\"matchCriteriaId\":\"2B256485-E289-4092-B45B-835DE12625B9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update42:*:*:*:*:*:*\",\"matchCriteriaId\":\"119B54BD-75F4-46A4-A57D-16CFF4E12CEB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update43:*:*:*:*:*:*\",\"matchCriteriaId\":\"A3382E2D-A414-40A1-A330-619859756A36\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update44:*:*:*:*:*:*\",\"matchCriteriaId\":\"2E07B750-55B6-4DB6-B02B-216C2F5505A9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update45:*:*:*:*:*:*\",\"matchCriteriaId\":\"B921E670-480F-4793-A636-3855A1654908\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update46:*:*:*:*:*:*\",\"matchCriteriaId\":\"62AE52FE-FB7F-4339-BDDE-E5AD235BBC58\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update47:*:*:*:*:*:*\",\"matchCriteriaId\":\"C99508DB-19E9-4832-AB38-57C61C7D68BC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update48:*:*:*:*:*:*\",\"matchCriteriaId\":\"67F50AF8-7B0E-4D01-9EB2-C6625E9DACB6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update49:*:*:*:*:*:*\",\"matchCriteriaId\":\"131E4E65-D997-47F1-8CB8-15CE6A60AB1D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update5:*:*:*:*:*:*\",\"matchCriteriaId\":\"DF1BB9E6-D690-4C12-AEF0-4BD712869CBA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update50:*:*:*:*:*:*\",\"matchCriteriaId\":\"CCD1DEA0-8823-4780-B5EE-C1A2BB3C6B4F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update51:*:*:*:*:*:*\",\"matchCriteriaId\":\"94AC684E-3C5F-4859-B6EB-42C478F9DD11\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update52:*:*:*:*:*:*\",\"matchCriteriaId\":\"DC6FF5AB-B6E4-45D9-854B-29DEC200DA4D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update53:*:*:*:*:*:*\",\"matchCriteriaId\":\"9855E3CB-925E-4623-A776-59422AB2FC6A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update54:*:*:*:*:*:*\",\"matchCriteriaId\":\"01C3B7BE-1F9B-4EDA-990C-A4022CB85612\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update55:*:*:*:*:*:*\",\"matchCriteriaId\":\"65CF766C-626D-4F8C-BDBF-F0C5404DD545\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update56:*:*:*:*:*:*\",\"matchCriteriaId\":\"720EF24C-9A36-405B-A380-6114C150B376\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update57:*:*:*:*:*:*\",\"matchCriteriaId\":\"44479EF5-40BD-43A2-AD0F-CE1660222AB2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update58:*:*:*:*:*:*\",\"matchCriteriaId\":\"B8E0BD92-0F77-481E-8167-F81755E00703\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update59:*:*:*:*:*:*\",\"matchCriteriaId\":\"2BDB885E-814A-4CA8-A81C-1DB35989089B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update6:*:*:*:*:*:*\",\"matchCriteriaId\":\"653A0452-070F-4312-B94A-F5BCB01B9BDC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update60:*:*:*:*:*:*\",\"matchCriteriaId\":\"B73DA1AE-C62F-4E62-AA98-5697656825F9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update61:*:*:*:*:*:*\",\"matchCriteriaId\":\"D49DEE85-4DDB-4EF4-9F4D-11E7C1364055\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update62:*:*:*:*:*:*\",\"matchCriteriaId\":\"365F28B6-DBF2-45BB-A06D-DD80CFBAD7BD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update63:*:*:*:*:*:*\",\"matchCriteriaId\":\"5FDAD47C-C2DA-4533-AA58-DD6EC09A580A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update64:*:*:*:*:*:*\",\"matchCriteriaId\":\"5F81F36F-B20F-48B3-A1F2-3D319A34176B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update65:*:*:*:*:*:*\",\"matchCriteriaId\":\"754329CD-30B7-4410-A371-56A7C261B61B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update66:*:*:*:*:*:*\",\"matchCriteriaId\":\"C9445405-6B94-4DD1-BA94-B600AA316BB7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update67:*:*:*:*:*:*\",\"matchCriteriaId\":\"960F3F22-9CC8-4655-9B09-777E5A5A1239\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update68:*:*:*:*:*:*\",\"matchCriteriaId\":\"D2B77C89-7F33-47A0-B6BF-473366033BEA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update69:*:*:*:*:*:*\",\"matchCriteriaId\":\"8183B9D5-1C4D-4D30-BD85-13850FF34CB2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update7:*:*:*:*:*:*\",\"matchCriteriaId\":\"15B67345-D0AF-4BFD-A62D-870F75306A4F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update70:*:*:*:*:*:*\",\"matchCriteriaId\":\"1675366A-2388-4F7E-B423-D39BC7D3D38D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update71:*:*:*:*:*:*\",\"matchCriteriaId\":\"B93C3CF2-4F45-4F6C-AB6D-F9ABDA7C4DA8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update72:*:*:*:*:*:*\",\"matchCriteriaId\":\"34A6A6A0-9307-4F5D-9605-1F786D1CD62A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update73:*:*:*:*:*:*\",\"matchCriteriaId\":\"6B994132-7103-4132-9D90-11CA264FEDE3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update74:*:*:*:*:*:*\",\"matchCriteriaId\":\"A1958E04-AB8A-4B0E-AB45-B810CAED2EEF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update75:*:*:*:*:*:*\",\"matchCriteriaId\":\"BB5558B0-6714-4B3A-B287-1943517A975A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update76:*:*:*:*:*:*\",\"matchCriteriaId\":\"7E325115-EEBC-41F4-8606-45270DA40B98\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update77:*:*:*:*:*:*\",\"matchCriteriaId\":\"848B2C72-447D-46E2-A5A7-43CF3764E578\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update78:*:*:*:*:*:*\",\"matchCriteriaId\":\"26A0AF15-52A9-46FD-8157-359141332EAF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update79:*:*:*:*:*:*\",\"matchCriteriaId\":\"63D63872-C1D0-444F-BCC7-A514F323C256\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update8:*:*:*:*:*:*\",\"matchCriteriaId\":\"DE1F4262-A054-48CC-BF1D-AA77A94FFFE4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update80:*:*:*:*:*:*\",\"matchCriteriaId\":\"9D9FA9AD-39D3-412A-B794-E1B29EEEEC4A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update81:*:*:*:*:*:*\",\"matchCriteriaId\":\"294D8A56-A797-433C-A06E-106B2179151A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update82:*:*:*:*:*:*\",\"matchCriteriaId\":\"824D88D9-4645-4CAD-8CAB-30F27DD388C4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update83:*:*:*:*:*:*\",\"matchCriteriaId\":\"F6E8C952-B455-46E4-AC3D-D38CAF189F60\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update84:*:*:*:*:*:*\",\"matchCriteriaId\":\"CD77C0EE-AC79-4443-A502-C1E02F806911\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update85:*:*:*:*:*:*\",\"matchCriteriaId\":\"648EB53C-7A90-4DA6-BF1C-B5336CDE30C7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update86:*:*:*:*:*:*\",\"matchCriteriaId\":\"39835EF7-8E93-4695-973D-6E9B76C67372\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update87:*:*:*:*:*:*\",\"matchCriteriaId\":\"2A05FB86-332B-44E3-93CB-82465A38976E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:liferay:digital_experience_platform:7.4:update9:*:*:*:*:*:*\",\"matchCriteriaId\":\"D176CECA-2821-49EA-86EC-1184C133C0A3\"}]}]}],\"references\":[{\"url\":\"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2023-37940\",\"source\":\"security@liferay.com\",\"tags\":[\"Vendor Advisory\"]}]}}",
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-37940\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-12-17T21:41:20.332148Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-12-17T21:41:34.805Z\"}}], \"cna\": {\"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"milCERT AT\"}, {\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"Abderrahmane BOUNHIDJA\"}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 4.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"HIGH\", \"confidentialityImpact\": \"LOW\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Liferay\", \"product\": \"Portal\", \"versions\": [{\"status\": \"affected\", \"version\": \"7.0.0\", \"versionType\": \"maven\", \"lessThanOrEqual\": \"7.4.3.87\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Liferay\", \"product\": \"DXP\", \"versions\": [{\"status\": \"affected\", \"version\": \"7.0.10\", \"versionType\": \"maven\", \"lessThanOrEqual\": \"de-102\"}, {\"status\": \"affected\", \"version\": \"7.1.10\", \"versionType\": \"maven\", \"lessThanOrEqual\": \"dxp-28\"}, {\"status\": \"affected\", \"version\": \"7.2.10\", \"versionType\": \"maven\", \"lessThanOrEqual\": \"dxp-20\"}, {\"status\": \"affected\", \"version\": \"7.3.10\", \"versionType\": \"maven\", \"lessThanOrEqual\": \"7.3.10-u29\"}, {\"status\": \"affected\", \"version\": \"7.4.13\", \"versionType\": \"maven\", \"lessThanOrEqual\": \"7.4.13-u87\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2023-37940\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Cross-site scripting (XSS) vulnerability in the edit Service Access Policy page in Liferay Portal 7.0.0 through 7.4.3.87, and Liferay DXP 7.4 GA through update 87, 7.3 GA through update 29, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a service access policy\u0027s `Service Class` text field.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Cross-site scripting (XSS) vulnerability in the edit Service Access Policy page in Liferay Portal 7.0.0 through 7.4.3.87, and Liferay DXP 7.4 GA through update 87, 7.3 GA through update 29, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a service access policy\u0027s `Service Class` text field.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-79\", \"description\": \"CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"8b54e794-c6f0-462e-9faa-c1001a673ac3\", \"shortName\": \"Liferay\", \"dateUpdated\": \"2024-12-17T21:30:39.730Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2023-37940\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-12-17T21:41:38.543Z\", \"dateReserved\": \"2023-07-11T09:17:17.552Z\", \"assignerOrgId\": \"8b54e794-c6f0-462e-9faa-c1001a673ac3\", \"datePublished\": \"2024-12-17T21:30:39.730Z\", \"assignerShortName\": \"Liferay\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…