--- title: "Security digest: October 17, 2023" url: https://erroneo.us/security/2023-10-17/ description: "October 17, 2023 vulnerability digest: 11 critical advisories (Maven, npm, Go). What to patch and who can relax." type: security-digest-day section: "Security Digest" date_published: 2023-10-17 date_modified: 2023-10-17 publisher: erroneo.us author: erroneo.us Security Desk license: All rights reserved. Quote with attribution and a link. --- # Security digest: October 17, 2023 11 critical advisories. ## Take stock - Maven: 8 critical advisories ( com.liferay:com.liferay.translation.web , com.liferay.portal:release.dxp.bom , com.liferay.commerce:com.liferay.commerce.address.content.web , com.liferay:com.liferay.fragment.entry.processor.impl , com.liferay:com.liferay.layout.impl , com.liferay:com.liferay.wiki.web , com.xwiki.identity-oauth:identity-oauth-ui , com.liferay:com.liferay.asset.categories.admin.web …). Check with mvn dependency:tree -Dincludes=: . - Go: 2 critical advisories ( github.com/gofiber/fiber/v2 , github.com/consensys/gnark ). Check with govulncheck ./... . - npm: 1 critical advisory ( @seal-security/mongoose-fixed ). Check with npm audit (or: npm ls ) . - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully. ## Known exploited (CISA KEV) None. ## Critical advisories - [CVE-2023-42497](https://erroneo.us/security/cve/CVE-2023-42497/index.md) Liferay Portal and Liferay DXP Vulnerable to Reflected XSS via the Export for Translation Page — Maven com.liferay:com.liferay.translation.web < 2.0.86 → 2.0.86; Maven com.liferay.portal:release.dxp.bom >= 7.4.0, < 7.4.13.u86 → 7.4.13.u86 - [GHSA-rc4v-99cr-pjcm](https://erroneo.us/security/ghsa/GHSA-rc4v-99cr-pjcm/index.md) Prototype Pollution in ali-security/mongoose — npm @seal-security/mongoose-fixed = 5.3.3 → 5.3.4 - [CVE-2023-42627](https://erroneo.us/security/cve/CVE-2023-42627/index.md) Liferay Portal and Liferay DXP Vulnerable to XSS in the Commerce Module — Maven com.liferay.commerce:com.liferay.commerce.address.content.web < 4.0.35 → 4.0.35; Maven com.liferay.portal:release.dxp.bom >= 7.3.0, <= 7.3.10.u33 → no fix; Maven com.liferay.portal:release.dxp.bom >= 7.4.0, <= 7.4.13.u92 → no fix - [CVE-2023-44309](https://erroneo.us/security/cve/CVE-2023-44309/index.md) Liferay Portal and Liferay DXP Vulnerable to XSS in the Fragment Components — Maven com.liferay:com.liferay.fragment.entry.processor.impl < 3.0.25 → 3.0.25; Maven com.liferay.portal:release.dxp.bom >= 7.4.0, < 7.4.13.u54 → 7.4.13.u54 - [CVE-2023-44310](https://erroneo.us/security/cve/CVE-2023-44310/index.md) Liferay Portal and Liferay DXP Vulnerable to XSS via the Page Tree Menu — Maven com.liferay:com.liferay.layout.impl < 6.0.102 → 6.0.102; Maven com.liferay.portal:release.dxp.bom >= 7.3.10.fp1, <= 7.3.10.fp23 → no fix; Maven com.liferay.portal:release.dxp.bom >= 7.4.0, < 7.4.13.u79 → 7.4.13.u79 - [CVE-2023-42628](https://erroneo.us/security/cve/CVE-2023-42628/index.md) Liferay Portal and Liferay DXP Vulnerable to XSS in the Wiki Widget — Maven com.liferay:com.liferay.wiki.web < 7.0.95 → 7.0.95; Maven com.liferay.portal:release.dxp.bom >= 7.0.10.fp83, <= 7.0.10.fp102 → no fix; Maven com.liferay.portal:release.dxp.bom >= 7.1.0, <= 7.1.10.fp28 → no fix - [CVE-2023-45144](https://erroneo.us/security/cve/CVE-2023-45144/index.md) XWiki Identity Oauth Privilege escalation (PR)/remote code execution from login screen through unescaped URL parameter — Maven com.xwiki.identity-oauth:identity-oauth-ui >= 1.0, < 1.6 → 1.6 - [CVE-2023-42629](https://erroneo.us/security/cve/CVE-2023-42629/index.md) Liferay Portal and Liferay DXP Vulnerable to Stored XSS in the Manage Vocabulary Page — Maven com.liferay:com.liferay.asset.categories.admin.web < 5.0.87 → 5.0.87; Maven com.liferay.portal:release.dxp.bom >= 7.4.0, < 7.4.13.u88 → 7.4.13.u88 - [CVE-2023-45128](https://erroneo.us/security/cve/CVE-2023-45128/index.md) CSRF Token Reuse Vulnerability — Go github.com/gofiber/fiber/v2 < 2.50.0 → 2.50.0 - [GHSA-7p92-x423-vwj6](https://erroneo.us/security/ghsa/GHSA-7p92-x423-vwj6/index.md) Plonk verifier KZG multi point verification — Go github.com/consensys/gnark < 0.9.1 → 0.9.1 - [CVE-2023-44311](https://erroneo.us/security/cve/CVE-2023-44311/index.md) Liferay Portal and Liferay DXP Vulnerable to XSS via the OAuth2ProviderApplicationRedirect Class — Maven com.liferay:com.liferay.oauth2.provider.rest < 4.0.51 → 4.0.51; Maven com.liferay.portal:release.dxp.bom >= 7.4.13.u41, < 7.4.13.u90 → 7.4.13.u90 --- Source page: https://erroneo.us/security/2023-10-17/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt