Reflected cross-site scripting (XSS) vulnerability in the Language Override edit screen in Liferay Portal 7.4.3.8 through 7.4.3.97, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 4 through 92 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_portal_language_override_web_internal_portlet_PLOPortlet_key parameter.
Severity
Medium 6.1
Published
21 Feb 2024
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
7.4.3.98
Sources
NVD
Affected software
Software
Affected versions
Liferay Portal / DXPServers and applications · cpe:a:liferay:digital_experience_platform
Version 2023.q3.4
Version 2023.q3.3
Version 2023.q3.2
Version 2023.q3.1
All 94 release lines
Version 7.4-update4
Version 7.4-update5
Version 7.4-update6
Version 7.4-update7
Version 7.4-update8
Version 7.4-update9
Version 7.4-update10
Version 7.4-update11
Version 7.4-update12
Version 7.4-update13
Version 7.4-update14
Version 7.4-update15
Version 7.4-update16
Version 7.4-update17
Version 7.4-update18
Version 7.4-update19
Version 7.4-update20
Version 7.4-update21
Version 7.4-update22
Version 7.4-update23
Version 7.4-update24
Version 7.4-update25
Version 7.4-update26
Version 7.4-update27
Version 7.4-update28
Version 7.4-update29
Version 7.4-update30
Version 7.4-update31
Version 7.4-update32
Version 7.4-update33
Version 7.4-update34
Version 7.4-update35
Version 7.4-update36
Version 7.4-update37
Version 7.4-update38
Version 7.4-update39
Version 7.4-update40
Version 7.4-update41
Version 7.4-update42
Version 7.4-update43
Version 7.4-update44
Version 7.4-update45
Version 7.4-update46
Version 7.4-update47
Version 7.4-update48
Version 7.4-update49
Version 7.4-update50
Version 7.4-update51
Version 7.4-update52
Version 7.4-update53
Version 7.4-update54
Version 7.4-update55
Version 7.4-update56
Version 7.4-update57
Version 7.4-update58
Version 7.4-update59
Version 7.4-update60
Version 7.4-update61
Version 7.4-update62
Version 7.4-update63
Version 7.4-update64
Version 7.4-update65
Version 7.4-update66
Version 7.4-update67
Version 7.4-update68
Version 7.4-update69
Version 7.4-update70
Version 7.4-update71
Version 7.4-update72
Version 7.4-update73
Version 7.4-update74
Version 7.4-update75
Version 7.4-update76
Version 7.4-update77
Version 7.4-update78
Version 7.4-update79
Version 7.4-update80
Version 7.4-update81
Version 7.4-update82
Version 7.4-update83
Version 7.4-update84
Version 7.4-update85
Version 7.4-update86
Version 7.4-update87
Version 7.4-update88
Version 7.4-update89
Version 7.4-update90
Version 7.4-update91
Version 7.4-update92
Version 2023.q3.0
Version 2023.q3.1
Version 2023.q3.2
Version 2023.q3.3
Version 2023.q3.4
Liferay Portal / DXPServers and applications · cpe:a:liferay:liferay_portal