CVE-2023-44311
Liferay Portal and Liferay DXP Vulnerable to XSS via the OAuth2ProviderApplicationRedirect Class
Multiple reflected cross-site scripting (XSS) vulnerabilities in the Plugin for OAuth 2.0 module's OAuth2ProviderApplicationRedirect class in Liferay Portal 7.4.3.41 through 7.4.3.89, and Liferay DXP 7.4 update 41 through update 89 allow remote attackers to inject arbitrary web script or HTML via the (1) code, or (2) error parameter. This issue is caused by an incomplete fix in CVE-2023-33941.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Multiple reflected cross-site scripting (XSS) vulnerabilities in the Plugin for OAuth 2.0 module's OAuth2ProviderApplicationRedirect class in Liferay Portal 7.4.3.41 through 7.4.3.89, and Liferay DXP 7.4 update 41 through update 89 allow remote attackers to inject arbitrary web script or HTML via the (1) code, or (2) error parameter. This issue is caused by an incomplete fix in CVE-2023-33941.
- Record
CVE-2023-44311- CVSS 3.1
- 9.6 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2023-48667
Multiple reflected cross-site scripting (XSS) vulnerabilities in the Plugin for OAuth 2.0 module's OAuth2ProviderApplicationRedirect class in Liferay Portal 7.4.3.41 through 7.4.3.89, and Liferay DXP 7.4 update 41 through update 89 allow remote attackers to inject arbitrary web script or HTML via the (1) code, or (2) error parameter. This issue is caused by an incomplete fix in CVE-2023-33941.
- Record
EUVD-2023-48667- CVSS 3.1
- 9.6 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-49gm-5685-8fxv
Liferay Portal and Liferay DXP Vulnerable to XSS via the OAuth2ProviderApplicationRedirect Class
Multiple reflected cross-site scripting (XSS) vulnerabilities in the Plugin for OAuth 2.0 module's OAuth2ProviderApplicationRedirect class before 4.0.51 from Liferay Portal (7.4.3.41 through 7.4.3.89), and Liferay DXP 7.4 update 41 through update 89 allow remote attackers to inject arbitrary web script or HTML via the (1) code, or (2) error parameter. This issue is caused by an incomplete fix in CVE-2023-33941.
- Record
GHSA-49gm-5685-8fxv- CVSS 3.1
- 9.6 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
Multiple reflected cross-site scripting (XSS) vulnerabilities in the Plugin for OAuth 2.0 module's OAuth2ProviderApplicationRedirect class in Liferay Portal 7.4.3.41 through 7.4.3.89, and Liferay DXP 7.4 update 41 through update 89 allow remote attackers to inject arbitrary web script or HTML via the (1) code, or (2) error parameter. This issue is caused by an incomplete fix in CVE-2023-33941.
- Record
CVE-2023-44311- CVSS 3.1
- 9.6 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H - CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
Multiple reflected cross-site scripting (XSS) vulnerabilities in the Plugin for OAuth 2.0 module's OAuth2ProviderApplicationRedirect class in Liferay Portal 7.4.3.41 through 7.4.3.89, and Liferay DXP 7.4 update 41 through update 89 allow remote attackers to inject arbitrary web script or HTML via the (1) code, or (2) error parameter. This issue is caused by an incomplete fix in CVE-2023-33941.
- Record
CVE-2023-44311- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-49gm-5685-8fxv
Liferay Portal and Liferay DXP Vulnerable to XSS via the OAuth2ProviderApplicationRedirect Class
Multiple reflected cross-site scripting (XSS) vulnerabilities in the Plugin for OAuth 2.0 module's OAuth2ProviderApplicationRedirect class before 4.0.51 from Liferay Portal (7.4.3.41 through 7.4.3.89), and Liferay DXP 7.4 update 41 through update 89 allow remote attackers to inject arbitrary web script or HTML via the (1) code, or (2) error parameter. This issue is caused by an incomplete fix in CVE-2023-33941.
- Record
GHSA-49gm-5685-8fxv- CVSS 3.1
- 9.6 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVBIT-liferay-2023-44311 No score
Multiple reflected cross-site scripting (XSS) vulnerabilities in the Plugin for OAuth 2.0 module's OAuth2ProviderApplicationRedirect class in Liferay Portal 7.4.3.41 through 7.4.3.89, and Liferay DXP 7.4 update 41 through update 89 allow remote attackers to inject arbitrary web script or HTML via the (1) code, or (2) error parameter. This issue is caused by an incomplete fix in CVE-2023-33941.
- Record
BIT-liferay-2023-44311- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
com.liferay:com.liferay.oauth2.provider.restMaven |
before 4.0.51 | 4.0.51 |
com.liferay.portal:release.dxp.bomMaven |
7.4.13.u41 up to 7.4.13.u90 | 7.4.13.u90 |
liferayBitnami |
7.4-update41.0 to 7.4-update41.0, 7.4-update48.0 to 7.4-update48.0, 7.4-update50.0 to 7.4-update50.0, 7.4-update52.0 to 7.4-update52.0, 7.4-update62.0 to 7.4-update62.0, 7.4-update67.0 to 7.4-update67.0, 7.4-update76.0 to 7.4-update76.0, 7.4-update81.0 to 7.4-update81.0, 7.4-update82.0 to 7.4-update82.0, 7.4-update83.0 to 7.4-update83.0, 7.4-update84.0 to 7.4-update84.0, 7.4-update85.0 to 7.4-update85.0, 7.4-update86.0 to 7.4-update86.0 | None known |
com.liferay:com.liferay.oauth2.provider.restMaven |
before 4.0.51, plus listed versions 1.0.01.0.11.0.101.0.111.0.12 Show 45 moreShow less1.0.131.0.141.0.151.0.161.0.171.0.181.0.191.0.21.0.201.0.211.0.221.0.231.0.241.0.251.0.261.0.271.0.281.0.291.0.31.0.301.0.311.0.321.0.331.0.341.0.351.0.361.0.371.0.381.0.391.0.41.0.401.0.411.0.421.0.431.0.441.0.451.0.461.0.471.0.481.0.491.0.51.0.501.0.511.0.521.0.53 |
4.0.51 |
com.liferay.portal:release.dxp.bomMaven |
7.4.13.u41 up to 7.4.13.u90, plus listed versions 7.4.13.u427.4.13.u437.4.13.u447.4.13.u457.4.13.u46 Show 43 moreShow less7.4.13.u477.4.13.u487.4.13.u497.4.13.u507.4.13.u517.4.13.u527.4.13.u537.4.13.u547.4.13.u557.4.13.u567.4.13.u577.4.13.u587.4.13.u597.4.13.u607.4.13.u617.4.13.u627.4.13.u637.4.13.u647.4.13.u657.4.13.u667.4.13.u677.4.13.u687.4.13.u697.4.13.u707.4.13.u717.4.13.u727.4.13.u737.4.13.u747.4.13.u757.4.13.u767.4.13.u777.4.13.u787.4.13.u797.4.13.u807.4.13.u817.4.13.u827.4.13.u837.4.13.u847.4.13.u857.4.13.u867.4.13.u877.4.13.u887.4.13.u89 |
7.4.13.u90 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-44311 is a critical vulnerability (CVSS 9.6) in Liferay Dxp, published October 17, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.57%, the 47th percentile. Fixed in com.liferay:com.liferay.oauth2.provider.rest 4.0.51.
References
liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-44311
nvd.nist.gov/vuln/detail/CVE-2023-44311
github.com/liferay/liferay-portal/commit/c07e48d9f489b24e97e71139ac5aa7ef339d9ee9
liferay.atlassian.net/browse/LPE-17804
Left out here: 201 versions. The JSON record has them.