Cross-site scripting (XSS) vulnerability in Layout module in Liferay Portal 7.3.4 through 7.4.3.68, and Liferay DXP 7.3 before update 24, and 7.4 before update 69 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a container type layout fragment's `URL` text field.
Severity
Medium 6.1
Published
24 May 2023
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Sources
NVD
Affected software
Software
Affected versions
Liferay Portal / DXPServers and applications · cpe:a:liferay:digital_experience_platform
From 7.4.0 up to 7.4.3.68
Version 7.3-update24
Version 7.3-update23
Version 7.3-update22
All 25 release lines
Version 7.3-update1
Version 7.3-update2
Version 7.3-update3
Version 7.3-update4
Version 7.3-update5
Version 7.3-update6
Version 7.3-update7
Version 7.3-update8
Version 7.3-update9
Version 7.3-update10
Version 7.3-update11
Version 7.3-update12
Version 7.3-update13
Version 7.3-update14
Version 7.3-update15
Version 7.3-update16
Version 7.3-update17
Version 7.3-update18
Version 7.3-update19
Version 7.3-update20
Version 7.3-update21
Version 7.3-update22
Version 7.3-update23
Version 7.3-update24
From 7.4.0 up to 7.4.3.68
Liferay Portal / DXPServers and applications · cpe:a:liferay:liferay_portal