CVE-2023-42628
Liferay Portal and Liferay DXP Vulnerable to XSS in the Wiki Widget
Stored cross-site scripting (XSS) vulnerability in the Wiki widget in Liferay Portal 7.1.0 through 7.4.3.87, and Liferay DXP 7.0 fix pack 83 through 102, 7.1 fix pack 28 and earlier, 7.2 fix pack 20 and earlier, 7.3 update 33 and earlier, and 7.4 before update 88 allows remote attackers to inject arbitrary web script or HTML into a parent wiki page via a crafted payload injected into a wiki page's ‘Content’ text field.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Stored cross-site scripting (XSS) vulnerability in the Wiki widget in Liferay Portal 7.1.0 through 7.4.3.87, and Liferay DXP 7.0 fix pack 83 through 102, 7.1 fix pack 28 and earlier, 7.2 fix pack 20 and earlier, 7.3 update 33 and earlier, and 7.4 before update 88 allows remote attackers to inject arbitrary web script or HTML into a parent wiki page via a crafted payload injected into a wiki page's ‘Content’ text field.
- Record
CVE-2023-42628- CVSS 3.1
- 9.0 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2023-47061
Stored cross-site scripting (XSS) vulnerability in the Wiki widget in Liferay Portal 7.1.0 through 7.4.3.87, and Liferay DXP 7.0 fix pack 83 through 102, 7.1 fix pack 28 and earlier, 7.2 fix pack 20 and earlier, 7.3 update 33 and earlier, and 7.4 before update 88 allows remote attackers to inject arbitrary web script or HTML into a parent wiki page via a crafted payload injected into a wiki page's ‘Content’ text field.
- Record
EUVD-2023-47061- CVSS 3.1
- 9.0 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-hv45-r2f5-fmhj
Liferay Portal and Liferay DXP Vulnerable to XSS in the Wiki Widget
Stored cross-site scripting (XSS) vulnerability in the Wiki widget in Liferay Wiki Web before 7.0.95 from Liferay Portal (7.1.0 through 7.4.3.87), and Liferay DXP 7.0 fix pack 83 through 102, 7.1 fix pack 28 and earlier, 7.2 fix pack 20 and earlier, 7.3 update 33 and earlier, and 7.4 before update 88 allows remote attackers to inject arbitrary web script or HTML into a parent wiki page via a crafted payload injected into a wiki page's ‘Content’ text field.
- Record
GHSA-hv45-r2f5-fmhj- CVSS 3.1
- 9.0 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
Stored cross-site scripting (XSS) vulnerability in the Wiki widget in Liferay Portal 7.1.0 through 7.4.3.87, and Liferay DXP 7.0 fix pack 83 through 102, 7.1 fix pack 28 and earlier, 7.2 fix pack 20 and earlier, 7.3 update 33 and earlier, and 7.4 before update 88 allows remote attackers to inject arbitrary web script or HTML into a parent wiki page via a crafted payload injected into a wiki page's ‘Content’ text field.
- Record
CVE-2023-42628- CVSS 3.1
- 9.0 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H - CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
Stored cross-site scripting (XSS) vulnerability in the Wiki widget in Liferay Portal 7.1.0 through 7.4.3.87, and Liferay DXP 7.0 fix pack 83 through 102, 7.1 fix pack 28 and earlier, 7.2 fix pack 20 and earlier, 7.3 update 33 and earlier, and 7.4 before update 88 allows remote attackers to inject arbitrary web script or HTML into a parent wiki page via a crafted payload injected into a wiki page's ‘Content’ text field.
- Record
CVE-2023-42628- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-hv45-r2f5-fmhj
Liferay Portal and Liferay DXP Vulnerable to XSS in the Wiki Widget
Stored cross-site scripting (XSS) vulnerability in the Wiki widget in Liferay Wiki Web before 7.0.95 from Liferay Portal (7.1.0 through 7.4.3.87), and Liferay DXP 7.0 fix pack 83 through 102, 7.1 fix pack 28 and earlier, 7.2 fix pack 20 and earlier, 7.3 update 33 and earlier, and 7.4 before update 88 allows remote attackers to inject arbitrary web script or HTML into a parent wiki page via a crafted payload injected into a wiki page's ‘Content’ text field.
- Record
GHSA-hv45-r2f5-fmhj- CVSS 3.1
- 9.0 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVBIT-liferay-2023-42628 No score
Stored cross-site scripting (XSS) vulnerability in the Wiki widget in Liferay Portal 7.1.0 through 7.4.3.87, and Liferay DXP 7.0 fix pack 83 through 102, 7.1 fix pack 28 and earlier, 7.2 fix pack 20 and earlier, 7.3 update 33 and earlier, and 7.4 before update 88 allows remote attackers to inject arbitrary web script or HTML into a parent wiki page via a crafted payload injected into a wiki page's ‘Content’ text field.
- Record
BIT-liferay-2023-42628- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
com.liferay:com.liferay.wiki.webMaven |
before 7.0.95 | 7.0.95 |
com.liferay.portal:release.dxp.bomMaven |
7.0.10.fp83 to 7.0.10.fp102 | None known |
com.liferay.portal:release.dxp.bomMaven |
7.1.0 to 7.1.10.fp28 | None known |
com.liferay.portal:release.dxp.bomMaven |
7.2.0 to 7.2.10.fp20 | None known |
com.liferay.portal:release.dxp.bomMaven |
7.3.0 up to 7.3.10.u34 | 7.3.10.u34 |
com.liferay.portal:release.dxp.bomMaven |
7.4.0 up to 7.4.13.u88 | 7.4.13.u88 |
liferayBitnami |
7.0.0 to 7.0.0, 7.1.0 to 7.1.0, 7.2.0 to 7.2.0, 7.3.0 to 7.3.0, 7.4.0 to 7.4.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.4-update1.0 to 7.4-update1.0, 7.4-update21.0 to 7.4-update21.0, 7.4-update34.0 to 7.4-update34.0, 7.4-update36.0 to 7.4-update36.0, 7.4-update41.0 to 7.4-update41.0, 7.4-update48.0 to 7.4-update48.0, 7.4-update50.0 to 7.4-update50.0, 7.4-update52.0 to 7.4-update52.0, 7.4-update62.0 to 7.4-update62.0, 7.4-update67.0 to 7.4-update67.0, 7.4-update76.0 to 7.4-update76.0, 7.4-update81.0 to 7.4-update81.0, 7.4-update82.0 to 7.4-update82.0, 7.4-update83.0 to 7.4-update83.0, 7.4-update84.0 to 7.4-update84.0, 7.4-update85.0 to 7.4-update85.0, 7.4-update86.0 to 7.4-update86.0 | None known |
com.liferay:com.liferay.wiki.webMaven |
before 7.0.95, plus listed versions 1.0.01.0.11.0.101.0.111.0.2 Show 45 moreShow less1.0.31.0.41.0.51.0.61.0.71.0.81.0.92.0.02.1.02.1.12.1.102.1.112.1.122.1.132.1.142.1.152.1.162.1.172.1.182.1.192.1.22.1.202.1.212.1.222.1.232.1.242.1.252.1.262.1.272.1.282.1.292.1.32.1.302.1.312.1.322.1.332.1.342.1.352.1.362.1.372.1.382.1.392.1.42.1.402.1.5 |
7.0.95 |
com.liferay.portal:release.dxp.bomMaven |
7.0.10.fp83 to 7.0.10.fp102, plus listed versions 7.0.10.fp1007.0.10.fp1017.0.10.fp847.0.10.fp857.0.10.fp85-1 Show 16 moreShow less7.0.10.fp867.0.10.fp86-17.0.10.fp877.0.10.fp87-17.0.10.fp887.0.10.fp897.0.10.fp907.0.10.fp917.0.10.fp927.0.10.fp947.0.10.fp94-17.0.10.fp957.0.10.fp95-17.0.10.fp95-27.0.10.fp977.0.10.fp98 |
None known |
com.liferay.portal:release.dxp.bomMaven |
7.1.0 to 7.1.10.fp28, plus listed versions 7.1.107.1.10.fp17.1.10.fp107.1.10.fp117.1.10.fp12 Show 21 moreShow less7.1.10.fp137.1.10.fp147.1.10.fp157.1.10.fp167.1.10.fp177.1.10.fp187.1.10.fp197.1.10.fp27.1.10.fp207.1.10.fp227.1.10.fp247.1.10.fp257.1.10.fp267.1.10.fp277.1.10.fp37.1.10.fp47.1.10.fp57.1.10.fp67.1.10.fp77.1.10.fp87.1.10.fp9 |
None known |
com.liferay.portal:release.dxp.bomMaven |
7.2.0 to 7.2.10.fp20, plus listed versions 7.2.17.2.107.2.10.fp17.2.10.fp1-17.2.10.fp10 Show 17 moreShow less7.2.10.fp117.2.10.fp127.2.10.fp137.2.10.fp147.2.10.fp157.2.10.fp167.2.10.fp177.2.10.fp187.2.10.fp197.2.10.fp27.2.10.fp37.2.10.fp47.2.10.fp57.2.10.fp67.2.10.fp77.2.10.fp87.2.10.fp9 |
None known |
com.liferay.portal:release.dxp.bomMaven |
7.3.0 up to 7.3.10.u34, plus listed versions 7.3.107.3.10.ep37.3.10.ep47.3.10.ep57.3.10.fp1 Show 35 moreShow less7.3.10.fp27.3.10.u107.3.10.u117.3.10.u127.3.10.u137.3.10.u147.3.10.u157.3.10.u167.3.10.u177.3.10.u187.3.10.u197.3.10.u19-17.3.10.u207.3.10.u20-17.3.10.u217.3.10.u21-17.3.10.u227.3.10.u22-17.3.10.u237.3.10.u247.3.10.u257.3.10.u267.3.10.u277.3.10.u287.3.10.u297.3.10.u307.3.10.u317.3.10.u327.3.10.u337.3.10.u47.3.10.u57.3.10.u67.3.10.u77.3.10.u87.3.10.u9 |
7.3.10.u34 |
com.liferay.portal:release.dxp.bomMaven |
7.4.0 up to 7.4.13.u88, plus listed versions 7.4.10.ep17.4.117.4.127.4.137.4.13.u1 Show 45 moreShow less7.4.13.u107.4.13.u157.4.13.u167.4.13.u177.4.13.u187.4.13.u197.4.13.u27.4.13.u207.4.13.u217.4.13.u227.4.13.u237.4.13.u247.4.13.u257.4.13.u267.4.13.u277.4.13.u287.4.13.u297.4.13.u37.4.13.u307.4.13.u317.4.13.u327.4.13.u337.4.13.u347.4.13.u357.4.13.u367.4.13.u377.4.13.u387.4.13.u397.4.13.u47.4.13.u407.4.13.u417.4.13.u427.4.13.u437.4.13.u447.4.13.u457.4.13.u467.4.13.u477.4.13.u487.4.13.u497.4.13.u57.4.13.u507.4.13.u517.4.13.u527.4.13.u537.4.13.u54 |
7.4.13.u88 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-42628 is a critical vulnerability (CVSS 9.0) in Liferay Dxp, published October 17, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.78%, the 86th percentile. Fixed in com.liferay:com.liferay.wiki.web 7.0.95.
References
Left out here: 541 versions. The JSON record has them.