What is GHSA-468x-frcm-ghx6?

GHSA-468x-frcm-ghx6 is a security advisory published by GitHub Security Advisories with Critical severity. Liferay Portal and Liferay DXP vulnerable to reflected Cross-site Scripting

Which CVE IDs does GHSA-468x-frcm-ghx6 cover?

GHSA-468x-frcm-ghx6 covers the following CVE IDs: CVE-2023-40191. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-468x-frcm-ghx6?

GHSA-468x-frcm-ghx6 has a CVSS v3 base score of 9.0, published by GitHub Security Advisories.

Which products are affected by GHSA-468x-frcm-ghx6?

GHSA-468x-frcm-ghx6 affects 3 products, including: maven/com.liferay.portal:release.portal.bom:\u003e= 7.4.3.44, \u003c= 7.4.3.97; maven/com.liferay.portal:release.dxp.bom:\u003e= 2023.Q3, \u003c 2023.Q3.6; maven/com.liferay.portal:release.dxp.bom:\u003e= 7.4.13.u44, \u003c= 7.4.13.u92.

GHSA-468x-frcm-ghx6CriticalCVSS 9.0

Liferay Portal and Liferay DXP vulnerable to reflected Cross-site Scripting

Vendor

GitHub Security Advisories

Published

February 21, 2024

Last Modified

March 20, 2026

🔗 CVE IDs covered (1)

CVE-2023-40191 →

📋 Description

Reflected cross-site scripting (XSS) vulnerability in the instance settings for Accounts in Liferay Portal 7.4.3.44 through 7.4.3.97, and Liferay DXP 2023.Q3 before patch 6, and 7.4 update 44 through 92 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into the “Blocked Email Domains” text field

🎯 Affected products3

maven/com.liferay.portal:release.portal.bom:>= 7.4.3.44, <= 7.4.3.97
maven/com.liferay.portal:release.dxp.bom:>= 2023.Q3, < 2023.Q3.6
maven/com.liferay.portal:release.dxp.bom:>= 7.4.13.u44, <= 7.4.13.u92

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2023-40191
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-40191
https://github.com/advisories/GHSA-468x-frcm-ghx6