Digest · Tuesday

Security digest: October 17, 2023

11 critical advisories.

Take stock

Maven: 8 critical advisories (com.liferay:com.liferay.translation.web, com.liferay.portal:release.dxp.bom, com.liferay.commerce:com.liferay.commerce.address.content.web, com.liferay:com.liferay.fragment.entry.processor.impl, com.liferay:com.liferay.layout.impl, com.liferay:com.liferay.wiki.web, com.xwiki.identity-oauth:identity-oauth-ui, com.liferay:com.liferay.asset.categories.admin.web …). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId>.
Go: 2 critical advisories (github.com/gofiber/fiber/v2, github.com/consensys/gnark). Check with govulncheck ./....
npm: 1 critical advisory (@seal-security/mongoose-fixed). Check with npm audit (or: npm ls <package>).
None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 11

GitHub-reviewed advisories rated critical, published this day (Pacific time).

Maven 8

Check: mvn dependency:tree -Dincludes=<groupId>:<artifactId>

Liferay Portal and Liferay DXP Vulnerable to Reflected XSS via the Export for Translation Page CVE-2023-42497 CVSS 9.6 Critical
com.liferay:com.liferay.translation.web < 2.0.86 → fixed in 2.0.86; com.liferay.portal:release.dxp.bom >= 7.4.0, < 7.4.13.u86 → fixed in 7.4.13.u86
Liferay Portal and Liferay DXP Vulnerable to XSS in the Commerce Module CVE-2023-42627 CVSS 9.6 Critical
com.liferay.commerce:com.liferay.commerce.address.content.web < 4.0.35 → fixed in 4.0.35; com.liferay.portal:release.dxp.bom >= 7.3.0, <= 7.3.10.u33 → no fix listed; com.liferay.portal:release.dxp.bom >= 7.4.0, <= 7.4.13.u92 → no fix listed
Liferay Portal and Liferay DXP Vulnerable to XSS in the Fragment Components CVE-2023-44309 CVSS 9.0 Critical
com.liferay:com.liferay.fragment.entry.processor.impl < 3.0.25 → fixed in 3.0.25; com.liferay.portal:release.dxp.bom >= 7.4.0, < 7.4.13.u54 → fixed in 7.4.13.u54
Liferay Portal and Liferay DXP Vulnerable to XSS via the Page Tree Menu CVE-2023-44310 CVSS 9.0 Critical
com.liferay:com.liferay.layout.impl < 6.0.102 → fixed in 6.0.102; com.liferay.portal:release.dxp.bom >= 7.3.10.fp1, <= 7.3.10.fp23 → no fix listed; com.liferay.portal:release.dxp.bom >= 7.4.0, < 7.4.13.u79 → fixed in 7.4.13.u79
Liferay Portal and Liferay DXP Vulnerable to XSS in the Wiki Widget CVE-2023-42628 CVSS 9.0 Critical
com.liferay:com.liferay.wiki.web < 7.0.95 → fixed in 7.0.95; com.liferay.portal:release.dxp.bom >= 7.0.10.fp83, <= 7.0.10.fp102 → no fix listed; com.liferay.portal:release.dxp.bom >= 7.1.0, <= 7.1.10.fp28 → no fix listed; +3 more packages
XWiki Identity Oauth Privilege escalation (PR)/remote code execution from login screen through unescaped URL parameter CVE-2023-45144 CVSS 10.0 Critical
com.xwiki.identity-oauth:identity-oauth-ui >= 1.0, < 1.6 → fixed in 1.6
Liferay Portal and Liferay DXP Vulnerable to Stored XSS in the Manage Vocabulary Page CVE-2023-42629 CVSS 9.0 Critical
com.liferay:com.liferay.asset.categories.admin.web < 5.0.87 → fixed in 5.0.87; com.liferay.portal:release.dxp.bom >= 7.4.0, < 7.4.13.u88 → fixed in 7.4.13.u88
Liferay Portal and Liferay DXP Vulnerable to XSS via the OAuth2ProviderApplicationRedirect Class CVE-2023-44311 CVSS 9.6 Critical
com.liferay:com.liferay.oauth2.provider.rest < 4.0.51 → fixed in 4.0.51; com.liferay.portal:release.dxp.bom >= 7.4.13.u41, < 7.4.13.u90 → fixed in 7.4.13.u90

Go 2

Check: govulncheck ./...

CSRF Token Reuse Vulnerability CVE-2023-45128 CVSS 9.6 Critical
github.com/gofiber/fiber/v2 < 2.50.0 → fixed in 2.50.0
Plonk verifier KZG multi point verification GHSA-7p92-x423-vwj6
github.com/consensys/gnark < 0.9.1 → fixed in 0.9.1

npm 1

Check: npm audit (or: npm ls <package>)

Prototype Pollution in ali-security/mongoose GHSA-rc4v-99cr-pjcm CVSS 10.0 Critical
@seal-security/mongoose-fixed = 5.3.3 → fixed in 5.3.4