CVE-2023-40191: 
Java vulnerability analysis and mitigation

CVE-2023-40191 is a reflected cross-site scripting (XSS) vulnerability discovered in Liferay Portal and Liferay DXP's instance settings for Accounts. The vulnerability affects Liferay Portal versions 7.4.3.44 through 7.4.3.97, Liferay DXP 2023.Q3 before patch 6, and Liferay DXP 7.4 update 44 through 92 (Liferay Advisory).

The vulnerability exists in the instance settings for Accounts where attackers can inject arbitrary web script or HTML through the "Blocked Email Domains" text field. The vulnerability has been assigned CWE-79 (Improper Neutralization of Input During Web Page Generation). The CVSS v3.1 severity ratings vary between sources, with Liferay Inc. assigning a Critical score of 9.0 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H), while NVD assigns a Medium score of 6.1 (NVD).

If successfully exploited, this vulnerability allows remote attackers to inject and execute arbitrary web scripts or HTML in the context of the targeted application. This could potentially lead to theft of sensitive data, session hijacking, or other malicious actions performed in the context of the affected user's session (NVD).

The vulnerability has been fixed in Liferay Portal version 7.4.3.98 and Liferay DXP 2023.Q3.6. Users are advised to upgrade to these or later versions to mitigate the vulnerability (Liferay Advisory).