Liferay Portal XSS Vulnerability

Liferay Portal is a Java-based enterprise portal software used by organizations for intranet and extranet applications. The vulnerability discovered in Liferay Portal 7.4.3.35 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.7, 7.4 update 35 through update 92, and 7.3 update 25 through update 36 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a user’s First Name, Middle Name, or Last Name text field.

Affected versions: 7.4.3.111, 2023 If you don't recognise this software, you're probably not affected.

1. Upgrade to Liferay Portal 7.4.3.111 or later.
2. For immediate mitigation:
   • Restrict network access to your Liferay Portal instance (firewall it from the public internet)
   • Audit admin account activity for suspicious access patterns
   • Monitor for unauthorized token creation

• Vendor Advisory