---
title: "CVE-2023-44310: Liferay Portal and Liferay DXP Vulnerable to XSS via the Page Tree Menu"
url: https://erroneo.us/security/cve/CVE-2023-44310/
description: "CVE-2023-44310 (com.liferay:com.liferay.layout.impl (Maven)): Stored cross-site scripting (XSS) vulnerability in Page Tree menu Liferay Portal 7.3.6 through…"
type: vulnerability-record
section: "Security Digest"
date_published: 2023-10-17
date_modified: 2025-07-15
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2023-44310"
kev: false
cvss: 9
epss: 0.00575
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2023-44310: Liferay Portal and Liferay DXP Vulnerable to XSS via the Page Tree Menu

**Signal:** Critical, preconditions apply. Severe if exploited, but exploitation needs conditions that may not apply to you. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- No confirmed exploitation. It is not in CISA’s KEV catalog and CISA’s SSVC assessment records no known exploitation. That can change quickly after a public write-up; re-check if you are affected.
- EPSS 0.6% , percentile 47: FIRST’s model estimates a 0.6% chance of exploitation activity in the next 30 days, higher than 47% of all scored CVEs (low). EPSS is a probability, not a verdict.
- Needs an account (low (any account)). Exposure depends on who can log in.
- Only applies if your dependency tree includes com.liferay:com.liferay.layout.impl (Maven) < 6.0.102, fixed in 6.0.102 ; com.liferay.portal:release.dxp.bom (Maven) >= 7.3.10.fp1, <= 7.3.10.fp23, no fixed version listed ; com.liferay.portal:release.dxp.bom (Maven) >= 7.4.0, < 7.4.13.u79, fixed in 7.4.13.u79 . Check your lockfile, including transitive dependencies.

## What it is

Stored cross-site scripting (XSS) vulnerability in Page Tree menu Liferay Portal 7.3.6 through 7.4.3.78, and Liferay DXP 7.3 fix pack 1 through update 23, and 7.4 before update 79 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into page's "Name" text field.

## Affected packages

- Maven `com.liferay:com.liferay.layout.impl` < 6.0.102 → fixed: 6.0.102
- Maven `com.liferay.portal:release.dxp.bom` >= 7.3.10.fp1, <= 7.3.10.fp23 → fixed: none listed
- Maven `com.liferay.portal:release.dxp.bom` >= 7.4.0, < 7.4.13.u79 → fixed: 7.4.13.u79

## Affected products (CVE record)

- Liferay DXP: 7.3.10.sp1 <= 7.3.10.u23, 7.4.13 <= 7.4.13.u78
- Liferay Portal: 7.3.6 <= 7.4.3.78

## Severity

- Liferay CVSS 3.1: 9 `CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H`
- GitHub CVSS 3.1: 9.0 `CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H`

## Exploitation

- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- CISA SSVC assessment: exploitation none , automatable no , technical impact partial .
- FIRST EPSS (model of 2026-10-21): 0.57% probability of exploitation activity in the next 30 days; percentile 47.

## Sources

- [liferay.dev](https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-44310)
- [GitHub Advisory GHSA-j5gv-w838-mmcx](https://github.com/advisories/GHSA-j5gv-w838-mmcx)
- [CVE.org record CVE-2023-44310](https://www.cve.org/CVERecord?id=CVE-2023-44310)
- [NVD entry CVE-2023-44310](https://nvd.nist.gov/vuln/detail/CVE-2023-44310)
- [github.com](https://github.com/liferay/liferay-portal/commit/45931175b6ae14df089f0304f86b5b0f66ac3c02)
- [liferay.atlassian.net](https://liferay.atlassian.net/browse/LPE-17725)
- [liferay.dev](https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-44310?p_r_p_assetEntryId=122124880&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D122124880%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse)

---
Source page: https://erroneo.us/security/cve/CVE-2023-44310/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt