CVE-2023-44310
Liferay Portal and Liferay DXP Vulnerable to XSS via the Page Tree Menu
Stored cross-site scripting (XSS) vulnerability in Page Tree menu Liferay Portal 7.3.6 through 7.4.3.78, and Liferay DXP 7.3 fix pack 1 through update 23, and 7.4 before update 79 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into page's "Name" text field.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Stored cross-site scripting (XSS) vulnerability in Page Tree menu Liferay Portal 7.3.6 through 7.4.3.78, and Liferay DXP 7.3 fix pack 1 through update 23, and 7.4 before update 79 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into page's "Name" text field.
- Record
CVE-2023-44310- CVSS 3.1
- 9.0 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2023-48666
Stored cross-site scripting (XSS) vulnerability in Page Tree menu Liferay Portal 7.3.6 through 7.4.3.78, and Liferay DXP 7.3 fix pack 1 through update 23, and 7.4 before update 79 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into page's "Name" text field.
- Record
EUVD-2023-48666- CVSS 3.1
- 9.0 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-j5gv-w838-mmcx
Liferay Portal and Liferay DXP Vulnerable to XSS via the Page Tree Menu
Stored cross-site scripting (XSS) vulnerability in Page Tree menu in Liferay Layout Implementation before 6.0.102 from Liferay Portal (7.3.6 through 7.4.3.78), and Liferay DXP 7.3 fix pack 1 through update 23, and 7.4 before update 79 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into page's "Name" text field.
- Record
GHSA-j5gv-w838-mmcx- CVSS 3.1
- 9.0 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
Stored cross-site scripting (XSS) vulnerability in Page Tree menu Liferay Portal 7.3.6 through 7.4.3.78, and Liferay DXP 7.3 fix pack 1 through update 23, and 7.4 before update 79 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into page's "Name" text field.
- Record
CVE-2023-44310- CVSS 3.1
- 9.0 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H - CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
Stored cross-site scripting (XSS) vulnerability in Page Tree menu Liferay Portal 7.3.6 through 7.4.3.78, and Liferay DXP 7.3 fix pack 1 through update 23, and 7.4 before update 79 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into page's "Name" text field.
- Record
CVE-2023-44310- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-j5gv-w838-mmcx
Liferay Portal and Liferay DXP Vulnerable to XSS via the Page Tree Menu
Stored cross-site scripting (XSS) vulnerability in Page Tree menu in Liferay Layout Implementation before 6.0.102 from Liferay Portal (7.3.6 through 7.4.3.78), and Liferay DXP 7.3 fix pack 1 through update 23, and 7.4 before update 79 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into page's "Name" text field.
- Record
GHSA-j5gv-w838-mmcx- CVSS 3.1
- 9.0 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVBIT-liferay-2023-44310 No score
Stored cross-site scripting (XSS) vulnerability in Page Tree menu Liferay Portal 7.3.6 through 7.4.3.78, and Liferay DXP 7.3 fix pack 1 through update 23, and 7.4 before update 79 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into page's "Name" text field.
- Record
BIT-liferay-2023-44310- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
com.liferay:com.liferay.layout.implMaven |
before 6.0.102 | 6.0.102 |
com.liferay.portal:release.dxp.bomMaven |
7.3.10.fp1 to 7.3.10.fp23 | None known |
com.liferay.portal:release.dxp.bomMaven |
7.4.0 up to 7.4.13.u79 | 7.4.13.u79 |
liferayBitnami |
7.4.0 to 7.4.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.4-update1.0 to 7.4-update1.0, 7.4-update21.0 to 7.4-update21.0, 7.4-update34.0 to 7.4-update34.0, 7.4-update36.0 to 7.4-update36.0, 7.4-update41.0 to 7.4-update41.0, 7.4-update48.0 to 7.4-update48.0, 7.4-update50.0 to 7.4-update50.0, 7.4-update52.0 to 7.4-update52.0, 7.4-update62.0 to 7.4-update62.0, 7.4-update67.0 to 7.4-update67.0, 7.4-update76.0 to 7.4-update76.0 | None known |
com.liferay:com.liferay.layout.implMaven |
before 6.0.102, plus listed versions 1.0.02.0.02.0.12.0.102.0.11 Show 45 moreShow less2.0.122.0.132.0.142.0.152.0.162.0.172.0.182.0.192.0.22.0.202.0.32.0.42.0.52.0.62.0.72.0.82.0.93.0.03.0.13.0.103.0.113.0.123.0.133.0.143.0.153.0.163.0.173.0.183.0.193.0.23.0.203.0.213.0.223.0.233.0.243.0.253.0.263.0.273.0.283.0.33.0.43.0.53.0.63.0.73.0.8 |
6.0.102 |
com.liferay.portal:release.dxp.bomMaven |
7.3.10.fp1 to 7.3.10.fp23, plus listed versions 7.3.10.fp2 |
None known |
com.liferay.portal:release.dxp.bomMaven |
7.4.0 up to 7.4.13.u79, plus listed versions 7.4.10.ep17.4.117.4.127.4.137.4.13.u1 Show 45 moreShow less7.4.13.u107.4.13.u157.4.13.u167.4.13.u177.4.13.u187.4.13.u197.4.13.u27.4.13.u207.4.13.u217.4.13.u227.4.13.u237.4.13.u247.4.13.u257.4.13.u267.4.13.u277.4.13.u287.4.13.u297.4.13.u37.4.13.u307.4.13.u317.4.13.u327.4.13.u337.4.13.u347.4.13.u357.4.13.u367.4.13.u377.4.13.u387.4.13.u397.4.13.u47.4.13.u407.4.13.u417.4.13.u427.4.13.u437.4.13.u447.4.13.u457.4.13.u467.4.13.u477.4.13.u487.4.13.u497.4.13.u57.4.13.u507.4.13.u517.4.13.u527.4.13.u537.4.13.u54 |
7.4.13.u79 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-44310 is a critical vulnerability (CVSS 9.0) in Liferay Dxp, published October 17, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.57%, the 47th percentile. Fixed in com.liferay:com.liferay.layout.impl 6.0.102.
References
liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-44310
nvd.nist.gov/vuln/detail/CVE-2023-44310
github.com/liferay/liferay-portal/commit/45931175b6ae14df089f0304f86b5b0f66ac3c02
liferay.atlassian.net/browse/LPE-17725
Left out here: 283 versions. The JSON record has them.