Liferay XSS Vulnerability

Liferay Portal is a popular Java-based enterprise portal software used by organizations for intranet and extranet applications. This vulnerability allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into an attachment's filename, potentially leading to cross-site scripting (XSS) attacks.

Affected versions: 7.4.3.101, 2023 If you don't recognise this software, you're probably not affected.

1. Upgrade to Liferay Portal 7.4.3.101 or later.
   • Maven: Update your pom.xml dependency version
2. Immediate mitigations:
   • Restrict network access to your Liferay instance (firewall it from the public internet)
   • Audit admin account activity for suspicious access patterns
   • Monitor for unauthorized token creation

• Vendor Advisory