CVE-2023-42629
Liferay Portal and Liferay DXP Vulnerable to Stored XSS in the Manage Vocabulary Page
Stored cross-site scripting (XSS) vulnerability in the manage vocabulary page in Liferay Portal 7.4.2 through 7.4.3.87, and Liferay DXP 7.4 before update 88 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a Vocabulary's 'description' text field.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Stored cross-site scripting (XSS) vulnerability in the manage vocabulary page in Liferay Portal 7.4.2 through 7.4.3.87, and Liferay DXP 7.4 before update 88 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a Vocabulary's 'description' text field.
- Record
CVE-2023-42629- CVSS 3.1
- 9.0 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2023-47062
Stored cross-site scripting (XSS) vulnerability in the manage vocabulary page in Liferay Portal 7.4.2 through 7.4.3.87, and Liferay DXP 7.4 before update 88 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a Vocabulary's 'description' text field.
- Record
EUVD-2023-47062- CVSS 3.1
- 9.0 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-g44j-f8wm-6622
Liferay Portal and Liferay DXP Vulnerable to Stored XSS in the Manage Vocabulary Page
Stored cross-site scripting (XSS) vulnerability in the manage vocabulary page in the Asset Categories Admin Web module before 5.0.87 from Liferay Portal (7.4.2 through 7.4.3.87), and Liferay DXP 7.4 before update 88 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a Vocabulary's 'description' text field.
- Record
GHSA-g44j-f8wm-6622- CVSS 3.1
- 9.0 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
Stored cross-site scripting (XSS) vulnerability in the manage vocabulary page in Liferay Portal 7.4.2 through 7.4.3.87, and Liferay DXP 7.4 before update 88 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a Vocabulary's 'description' text field.
- Record
CVE-2023-42629- CVSS 3.1
- 9.0 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H - CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
Stored cross-site scripting (XSS) vulnerability in the manage vocabulary page in Liferay Portal 7.4.2 through 7.4.3.87, and Liferay DXP 7.4 before update 88 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a Vocabulary's 'description' text field.
- Record
CVE-2023-42629- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-g44j-f8wm-6622
Liferay Portal and Liferay DXP Vulnerable to Stored XSS in the Manage Vocabulary Page
Stored cross-site scripting (XSS) vulnerability in the manage vocabulary page in the Asset Categories Admin Web module before 5.0.87 from Liferay Portal (7.4.2 through 7.4.3.87), and Liferay DXP 7.4 before update 88 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a Vocabulary's 'description' text field.
- Record
GHSA-g44j-f8wm-6622- CVSS 3.1
- 9.0 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVBIT-liferay-2023-42629 No score
Stored cross-site scripting (XSS) vulnerability in the manage vocabulary page in Liferay Portal 7.4.2 through 7.4.3.87, and Liferay DXP 7.4 before update 88 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a Vocabulary's 'description' text field.
- Record
BIT-liferay-2023-42629- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
com.liferay:com.liferay.asset.categories.admin.webMaven |
before 5.0.87 | 5.0.87 |
com.liferay.portal:release.dxp.bomMaven |
7.4.0 up to 7.4.13.u88 | 7.4.13.u88 |
liferayBitnami |
7.4.0 to 7.4.0, 7.4-update1.0 to 7.4-update1.0, 7.4-update21.0 to 7.4-update21.0, 7.4-update34.0 to 7.4-update34.0, 7.4-update36.0 to 7.4-update36.0, 7.4-update41.0 to 7.4-update41.0, 7.4-update48.0 to 7.4-update48.0, 7.4-update50.0 to 7.4-update50.0, 7.4-update52.0 to 7.4-update52.0, 7.4-update62.0 to 7.4-update62.0, 7.4-update67.0 to 7.4-update67.0, 7.4-update76.0 to 7.4-update76.0, 7.4-update81.0 to 7.4-update81.0, 7.4-update82.0 to 7.4-update82.0, 7.4-update83.0 to 7.4-update83.0, 7.4-update84.0 to 7.4-update84.0, 7.4-update85.0 to 7.4-update85.0, 7.4-update86.0 to 7.4-update86.0 | None known |
com.liferay:com.liferay.asset.categories.admin.webMaven |
before 5.0.87, plus listed versions 1.0.01.0.11.0.101.0.111.0.12 Show 45 moreShow less1.0.131.0.141.0.151.0.161.0.171.0.181.0.191.0.21.0.31.0.41.0.51.0.61.0.71.0.81.0.91.1.01.1.11.1.101.1.111.1.121.1.131.1.141.1.151.1.161.1.171.1.181.1.191.1.21.1.201.1.211.1.221.1.231.1.241.1.251.1.261.1.271.1.281.1.291.1.31.1.301.1.311.1.321.1.331.1.341.1.35 |
5.0.87 |
com.liferay.portal:release.dxp.bomMaven |
7.4.0 up to 7.4.13.u88, plus listed versions 7.4.10.ep17.4.117.4.127.4.137.4.13.u1 Show 45 moreShow less7.4.13.u107.4.13.u157.4.13.u167.4.13.u177.4.13.u187.4.13.u197.4.13.u27.4.13.u207.4.13.u217.4.13.u227.4.13.u237.4.13.u247.4.13.u257.4.13.u267.4.13.u277.4.13.u287.4.13.u297.4.13.u37.4.13.u307.4.13.u317.4.13.u327.4.13.u337.4.13.u347.4.13.u357.4.13.u367.4.13.u377.4.13.u387.4.13.u397.4.13.u47.4.13.u407.4.13.u417.4.13.u427.4.13.u437.4.13.u447.4.13.u457.4.13.u467.4.13.u477.4.13.u487.4.13.u497.4.13.u57.4.13.u507.4.13.u517.4.13.u527.4.13.u537.4.13.u54 |
7.4.13.u88 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-42629 is a critical vulnerability (CVSS 9.0) in Liferay Dxp, published October 17, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.78%, the 86th percentile. Fixed in com.liferay:com.liferay.asset.categories.admin.web 5.0.87.
References
liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-42629
pentagrid.ch/en/blog/stored-cross-site-scripting-vulnerabilities-in-liferay-portal
nvd.nist.gov/vuln/detail/CVE-2023-42629
github.com/liferay/liferay-portal/commit/2e02110747dd5cccb978623545bfa1f3ad0a5602
Left out here: 384 versions. The JSON record has them.