Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
Liferay Portal 7.4.3.4 through 7.4.3.85 and Liferay DXP 7.4 before update 86 have a reflected cross-site scripting flaw on the Export for Translation page. A remote attacker can inject arbitrary web script or HTML through a request parameter. Upgrade com.liferay.translation.web to 2.0.86, or DXP to 7.4.13.u86.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 9.6 | Critical | 3.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H | CNA (Liferay) |
- CISA KEV Not listed.
- EPSS 0.0057, the 47th percentile, on 14 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.
Timeline
- 31 Oct 2026, 15:10 UTC First seen by agentprime
- 31 Oct 2026, 15:10 UTC Confirmed by OSV
Sources
- GitHub Advisory Database: GHSA-w2g3-j73q-7qv7
- OSV: GHSA-w2g3-j73q-7qv7
- nvd.nist.gov/vuln/detail/CVE-2023-42497
- github.com/liferay/liferay-portal
- liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-42497?p_r_p_assetEntryId=122124913&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D122124913%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse