Django REST framework

Lookup for vulnerable packages by Package URL.

Purl pkg:maven/com.liferay.portal/release.dxp.bom@2023.Q3.6

Type maven

Namespace com.liferay.portal

Name release.dxp.bom

Version 2023.Q3.6

Qualifiers

Subpath

Is_vulnerable false

Next_non_vulnerable_version null

Latest_non_vulnerable_version null

Affected_by_vulnerabilities

Fixing_vulnerabilities

url VCID-ej5y-geq1-pkfn

vulnerability_id VCID-ej5y-geq1-pkfn

summary

Liferay Portal Document and Media widget and Liferay DXP vulnerable to stored Cross-site Scripting
Stored cross-site scripting (XSS) vulnerability in the Document and Media widget in Liferay Portal 7.4.3.18 through 7.4.3.101, and Liferay DXP 2023.Q3 before patch 6, and 7.4 update 18 through 92 allows remote authenticated users to inject arbitrary web script or HTML via a crafted payload injected into a document's “Title” text field.

references

reference_url	https://github.com/liferay/liferay-portal
reference_id
reference_type
scores
url	https://github.com/liferay/liferay-portal

reference_url	https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-47795
reference_id	CVE-2023-47795
reference_type
scores
url	https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-47795

reference_url	https://nvd.nist.gov/vuln/detail/CVE-2023-47795
reference_id	CVE-2023-47795
reference_type
scores
url	https://nvd.nist.gov/vuln/detail/CVE-2023-47795

reference_url	https://github.com/advisories/GHSA-q2cv-7j58-rfmj
reference_id	GHSA-q2cv-7j58-rfmj
reference_type
scores
url	https://github.com/advisories/GHSA-q2cv-7j58-rfmj

fixed_packages

url	pkg:maven/com.liferay.portal/release.dxp.bom@2023.Q3.6
purl	pkg:maven/com.liferay.portal/release.dxp.bom@2023.Q3.6
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@2023.Q3.6

aliases CVE-2023-47795, GHSA-q2cv-7j58-rfmj

risk_score null

exploitability null

weighted_severity null

resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-ej5y-geq1-pkfn

url VCID-mbd8-z3ry-cqap

vulnerability_id VCID-mbd8-z3ry-cqap

summary

Liferay Portal and Liferay DXP Vulnerable to Open Redirect in Countries Management's Edit Region Page
Open redirect vulnerability in the Countries Management’s edit region page in Liferay Portal 7.4.3.45 through 7.4.3.101, and Liferay DXP 2023.Q3 before patch 6, and 7.4 update 45 through 92 allows remote attackers to redirect users to arbitrary external URLs via the _com_liferay_address_web_internal_portlet_CountriesManagementAdminPortlet_redirect parameter.

references

reference_url	https://github.com/liferay/liferay-portal
reference_id
reference_type
scores
url	https://github.com/liferay/liferay-portal

reference_url	https://github.com/liferay/liferay-portal/commit/26277c22498eb03bb192bbe9e5d2ee34d213780b
reference_id
reference_type
scores
url	https://github.com/liferay/liferay-portal/commit/26277c22498eb03bb192bbe9e5d2ee34d213780b

reference_url	https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-5190
reference_id	CVE-2023-5190
reference_type
scores
url	https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-5190

reference_url	https://nvd.nist.gov/vuln/detail/CVE-2023-5190
reference_id	CVE-2023-5190
reference_type
scores
url	https://nvd.nist.gov/vuln/detail/CVE-2023-5190

reference_url	https://github.com/advisories/GHSA-f3rf-cr7f-cwc4
reference_id	GHSA-f3rf-cr7f-cwc4
reference_type
scores
url	https://github.com/advisories/GHSA-f3rf-cr7f-cwc4

fixed_packages

url	pkg:maven/com.liferay.portal/release.dxp.bom@2023.Q3.6
purl	pkg:maven/com.liferay.portal/release.dxp.bom@2023.Q3.6
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@2023.Q3.6

aliases CVE-2023-5190, GHSA-f3rf-cr7f-cwc4

risk_score null

exploitability null

weighted_severity null

resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-mbd8-z3ry-cqap

url VCID-mf9a-eusx-f3gb

vulnerability_id VCID-mf9a-eusx-f3gb

summary

Liferay Portal and Liferay DXP vulnerable to reflected Cross-site Scripting
Reflected cross-site scripting (XSS) vulnerability in the instance settings for Accounts in Liferay Portal 7.4.3.44 through 7.4.3.97, and Liferay DXP 2023.Q3 before patch 6, and 7.4 update 44 through 92 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into the “Blocked Email Domains” text field

references

reference_url	https://github.com/liferay/liferay-portal
reference_id
reference_type
scores
url	https://github.com/liferay/liferay-portal

reference_url	https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-40191
reference_id	CVE-2023-40191
reference_type
scores
url	https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-40191

reference_url	https://nvd.nist.gov/vuln/detail/CVE-2023-40191
reference_id	CVE-2023-40191
reference_type
scores
url	https://nvd.nist.gov/vuln/detail/CVE-2023-40191

reference_url	https://github.com/advisories/GHSA-468x-frcm-ghx6
reference_id	GHSA-468x-frcm-ghx6
reference_type
scores
url	https://github.com/advisories/GHSA-468x-frcm-ghx6

fixed_packages

url	pkg:maven/com.liferay.portal/release.dxp.bom@2023.Q3.6
purl	pkg:maven/com.liferay.portal/release.dxp.bom@2023.Q3.6
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@2023.Q3.6

aliases CVE-2023-40191, GHSA-468x-frcm-ghx6

risk_score null

exploitability null

weighted_severity null

resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-mf9a-eusx-f3gb

url VCID-xn1n-5rgc-83bg

vulnerability_id VCID-xn1n-5rgc-83bg

summary

Liferay Portal and Liferay DXP vulnerable to reflected Cross-site Scripting
Reflected cross-site scripting (XSS) vulnerability on the add assignees to a role page in Liferay Portal 7.3.3 through 7.4.3.97, and Liferay DXP 2023.Q3 before patch 6, 7.4 GA through update 92, and 7.3 before update 34 allows remote attackers to inject arbitrary web script or HTML via the `_com_liferay_roles_admin_web_portlet_RolesAdminPortlet_tabs2` parameter.

references

reference_url	https://github.com/liferay/liferay-portal
reference_id
reference_type
scores
url	https://github.com/liferay/liferay-portal

reference_url	https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-42496
reference_id	CVE-2023-42496
reference_type
scores
url	https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-42496

reference_url	https://nvd.nist.gov/vuln/detail/CVE-2023-42496
reference_id	CVE-2023-42496
reference_type
scores
url	https://nvd.nist.gov/vuln/detail/CVE-2023-42496

reference_url	https://github.com/advisories/GHSA-54pv-r62j-9qqc
reference_id	GHSA-54pv-r62j-9qqc
reference_type
scores
url	https://github.com/advisories/GHSA-54pv-r62j-9qqc

fixed_packages

url	pkg:maven/com.liferay.portal/release.dxp.bom@7.3.10.u34
purl	pkg:maven/com.liferay.portal/release.dxp.bom@7.3.10.u34
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.3.10.u34

url	pkg:maven/com.liferay.portal/release.dxp.bom@2023.Q3.6
purl	pkg:maven/com.liferay.portal/release.dxp.bom@2023.Q3.6
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@2023.Q3.6

aliases CVE-2023-42496, GHSA-54pv-r62j-9qqc

risk_score null

exploitability null

weighted_severity null

resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-xn1n-5rgc-83bg

Risk_score null

Resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@2023.Q3.6

Package Instance