CVE-2023-37940
Liferay Portal and Liferay DXP have Cross-site Scripting vulnerability in edit Service Access Policy page
Cross-site scripting (XSS) vulnerability in the edit Service Access Policy page in Liferay Portal 7.0.0 through 7.4.3.87, and Liferay DXP 7.4 GA through update 87, 7.3 GA through update 29, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a service access policy's Service Class text field.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Cross-site scripting (XSS) vulnerability in the edit Service Access Policy page in Liferay Portal 7.0.0 through 7.4.3.87, and Liferay DXP 7.4 GA through update 87, 7.3 GA through update 29, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a service access policy's Service Class text field.
- Record
CVE-2023-37940- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2024-3606
Cross-site scripting (XSS) vulnerability in the edit Service Access Policy page in Liferay Portal 7.0.0 through 7.4.3.87, and Liferay DXP 7.4 GA through update 87, 7.3 GA through update 29, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a service access policy's Service Class text field.
- Record
EUVD-2024-3606- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-px38-239g-x5mg
Liferay Portal and Liferay DXP have Cross-site Scripting vulnerability in edit Service Access Policy page
Cross-site scripting (XSS) vulnerability in the edit Service Access Policy page in Liferay Portal 7.0.0 through 7.4.3.87, and Liferay DXP 7.4 GA through update 87, 7.3 GA through update 29, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a service access policy's Service Class text field.
- Record
GHSA-px38-239g-x5mg- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
Cross-site scripting (XSS) vulnerability in the edit Service Access Policy page in Liferay Portal 7.0.0 through 7.4.3.87, and Liferay DXP 7.4 GA through update 87, 7.3 GA through update 29, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a service access policy's Service Class text field.
- Record
CVE-2023-37940- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
Cross-site scripting (XSS) vulnerability in the edit Service Access Policy page in Liferay Portal 7.0.0 through 7.4.3.87, and Liferay DXP 7.4 GA through update 87, 7.3 GA through update 29, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a service access policy's Service Class text field.
- Record
CVE-2023-37940- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-px38-239g-x5mg
Liferay Portal and Liferay DXP have Cross-site Scripting vulnerability in edit Service Access Policy page
Cross-site scripting (XSS) vulnerability in the edit Service Access Policy page in Liferay Portal 7.0.0 through 7.4.3.87, and Liferay DXP 7.4 GA through update 87, 7.3 GA through update 29, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a service access policy's Service Class text field.
- Record
GHSA-px38-239g-x5mg- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
com.liferay.portal:release.portal.bomMaven |
7.0.0 up to 7.4.3.88 | 7.4.3.88 |
com.liferay.portal:release.dxp.bomMaven |
7.0 up to 7.3.10.u30 | 7.3.10.u30 |
com.liferay.portal:release.dxp.bomMaven |
7.4 up to 7.4.13.u88 | 7.4.13.u88 |
com.liferay.portal:release.portal.bomMaven |
7.0.0 up to 7.4.3.88, plus listed versions 7.0.67.0.6-17.0.6-27.1.07.1.1 Show 45 moreShow less7.1.27.1.37.1.3-17.2.07.2.17.2.1-17.3.07.3.0-17.3.17.3.1-17.3.27.3.2-17.3.37.3.3-17.3.47.3.57.3.67.3.77.4.07.4.17.4.1-17.4.27.4.2-17.4.3.107.4.3.117.4.3.127.4.3.137.4.3.147.4.3.157.4.3.167.4.3.177.4.3.187.4.3.197.4.3.207.4.3.20-ga207.4.3.217.4.3.21-ga217.4.3.227.4.3.237.4.3.247.4.3.257.4.3.267.4.3.277.4.3.287.4.3.29 |
7.4.3.88 |
com.liferay.portal:release.dxp.bomMaven |
7.0 up to 7.3.10.u30, plus listed versions 7.0.10.147.0.10.14-17.0.10.167.0.10.177.0.10.7 Show 45 moreShow less7.0.10.87.0.10.97.0.10.fp1007.0.10.fp1017.0.10.fp1027.0.10.fp607.0.10.fp617.0.10.fp627.0.10.fp637.0.10.fp647.0.10.fp657.0.10.fp667.0.10.fp677.0.10.fp687.0.10.fp697.0.10.fp707.0.10.fp717.0.10.fp727.0.10.fp737.0.10.fp747.0.10.fp757.0.10.fp767.0.10.fp777.0.10.fp787.0.10.fp797.0.10.fp807.0.10.fp817.0.10.fp827.0.10.fp837.0.10.fp847.0.10.fp857.0.10.fp85-17.0.10.fp867.0.10.fp86-17.0.10.fp877.0.10.fp87-17.0.10.fp887.0.10.fp897.0.10.fp907.0.10.fp917.0.10.fp927.0.10.fp947.0.10.fp94-17.0.10.fp957.0.10.fp95-1 |
7.3.10.u30 |
com.liferay.portal:release.dxp.bomMaven |
7.4 up to 7.4.13.u88, plus listed versions 7.4.10.ep17.4.117.4.127.4.137.4.13.u1 Show 45 moreShow less7.4.13.u107.4.13.u157.4.13.u167.4.13.u177.4.13.u187.4.13.u197.4.13.u27.4.13.u207.4.13.u217.4.13.u227.4.13.u237.4.13.u247.4.13.u257.4.13.u267.4.13.u277.4.13.u287.4.13.u297.4.13.u37.4.13.u307.4.13.u317.4.13.u327.4.13.u337.4.13.u347.4.13.u357.4.13.u367.4.13.u377.4.13.u387.4.13.u397.4.13.u47.4.13.u407.4.13.u417.4.13.u427.4.13.u437.4.13.u447.4.13.u457.4.13.u467.4.13.u477.4.13.u487.4.13.u497.4.13.u57.4.13.u507.4.13.u517.4.13.u527.4.13.u537.4.13.u54 |
7.4.13.u88 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-37940 is a medium vulnerability (CVSS 4.8) in Liferay Dxp, published December 17, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.28%, the 20th percentile. Fixed in com.liferay.portal:release.portal.bom 7.4.3.88.
References
Left out here: 211 versions. The JSON record has them.