{"action":"Upgrade com.liferay.commerce:com.liferay.commerce.address.content.web to 4.0.35 or later.","affected":[{"fixed":"4.0.35","introduced":"0"}],"component":"com.liferay.commerce:com.liferay.commerce.address.content.web","cve_ids":["CVE-2023-42627"],"ecosystem":"Maven","epss":0.02785,"exploited":false,"fixed_versions":["4.0.35"],"ghsa_id":"GHSA-qp68-5v39-r869","id":"tcs_01M5N99WV98FQ5YPM3WAASXWM4","modified_at":"2025-07-29T13:12:18.343695Z","published_at":"2023-10-17T15:30:27Z","references":["https://osv.dev/vulnerability/GHSA-qp68-5v39-r869","https://nvd.nist.gov/vuln/detail/CVE-2023-42627","https://github.com/liferay/liferay-portal","https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-42627","https://www.pentagrid.ch/en/blog/stored-cross-site-scripting-vulnerabilities-in-liferay-portal"],"severity":{"label":"critical","score":9.6},"sources":[{"source":"osv","source_id":"GHSA-qp68-5v39-r869","url":"https://osv.dev/vulnerability/GHSA-qp68-5v39-r869"}],"summary":"Liferay Portal and Liferay DXP Vulnerable to XSS in the Commerce Module"}