CVE-2023-44311

Description

Multiple reflected cross-site scripting (XSS) vulnerabilities in the Plugin for OAuth 2.0 module's OAuth2ProviderApplicationRedirect class before 4.0.51 from Liferay Portal (7.4.3.41 through 7.4.3.89), and Liferay DXP 7.4 update 41 through update 89 allow remote attackers to inject arbitrary web script or HTML via the (1) code, or (2) error parameter. This issue is caused by an incomplete fix in CVE-2023-33941.

How to fix CVE-2023-44311

To remediate CVE-2023-44311, upgrade the affected package to a fixed version below.

• —no fix listed
• —upgrade to 4.0.51 or later
• —upgrade to 7.4.13.u90 or later

Is CVE-2023-44311 being exploited?

Low — EPSS is 0.2%, meaning exploitation activity has not been observed at scale.

Affected packages (3)

• >= 7.4-update41.0, <= 7.4-update41.0, >= 7.4-update48.0, <= 7.4-update48.0, >= 7.4-update50.0, <= 7.4-update50.0, >= 7.4-update52.0, <= 7.4-update52.0, >= 7.4-update62.0, <= 7.4-update62.0, >= 7.4-update67.0, <= 7.4-update67.0, >= 7.4-update76.0, <= 7.4-update76.0, >= 7.4-update81.0, <= 7.4-update81.0, >= 7.4-update82.0, <= 7.4-update82.0, >= 7.4-update83.0, <= 7.4-update83.0, >= 7.4-update84.0, <= 7.4-update84.0, >= 7.4-update85.0, <= 7.4-update85.0, >= 7.4-update86.0, <= 7.4-update86.0
• from 0, < 4.0.51
• >= 7.4.13.u41, < 7.4.13.u90

CVSS scores

References (6)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2023-44311
• PATCHgithub.com/liferay/liferay-portal
• WEBgithub.com/liferay/liferay-portal/commit/c07e48d9f489b24e97e71139ac5aa7ef339d9ee9
• WEBliferay.atlassian.net/browse/LPE-17804