cve/2023/CVE-2023-42498.md

### [CVE-2023-42498](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-42498)
![](https://img.shields.io/static/v1?label=Product&message=DXP&color=blue)
![](https://img.shields.io/static/v1?label=Product&message=Portal&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=2023.q3.1%3C%3D%202023.q3.4%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Version&message=7.4.3.8%3C%3D%207.4.3.97%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%20Improper%20Neutralization%20of%20Input%20During%20Web%20Page%20Generation%20('Cross-site%20Scripting')&color=brighgreen)

### Description

Reflected cross-site scripting (XSS) vulnerability in the Language Override edit screen in Liferay Portal 7.4.3.8 through 7.4.3.97, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 4 through 92 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_portal_language_override_web_internal_portlet_PLOPortlet_key parameter.

### POC

#### Reference
No PoCs from references.

#### Github
- https://github.com/fkie-cad/nvd-json-data-feeds