CVE-2023-44309
unknown
CVSS v3
—
CVSS v4 NEW
—
VIR risk
—
Description
Liferay Portal and Liferay DXP Vulnerable to XSS in the Fragment Components
Predictions
Exploit likelihood
30%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
No mitigations published for this CVE yet.
The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.
✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here withsource_tier=community-verified.
Package impact
| Ecosystem | Package | Vulnerable | Fixed |
|---|---|---|---|
| Maven | com.liferay:com.liferay.fragment.entry.processor.impl | <3.0.25 | 3.0.25 |
| Maven | com.liferay.portal:release.dxp.bom | >=7.4.0,<7.4.13.u54 | 7.4.13.u54 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2023-44309
- https://github.com/liferay/liferay-portal/commit/1287c68486d60b87179995d8b8bd530031300a47
- https://github.com/liferay/liferay-portal/commit/28f8a7aabccce45e9d60cfb0cf63fc53c99b0d26
- https://github.com/liferay/liferay-portal/commit/9031a7a03e5891e7ccf762011fe8bcc2e433b1db
- https://github.com/liferay/liferay-portal/commit/ba628735cfae8656ab4243ecffce260413ed2460
- https://github.com/liferay/liferay-portal/commit/d70fecd2c5709d8dd5f4992b408a640ce912001b
- https://github.com/liferay/liferay-portal/commit/e45bf2d00ed7f95f02702a1da3e4115ab30b1bff
- https://github.com/liferay/liferay-portal/commit/ed856dd9e2947e3e660d7cfbdb8c604b296db790
- https://github.com/liferay/liferay-portal
- https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-44309
Community-verified mitigations for this CVE will appear above when contributors publish them.
Verify integrity in audit chain (admin only). AS-IS.