CVEvulnerability
CVE-2022-38902
5.4 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2022-10-13
- Last modified
- 2026-07-09
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 5.4 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 5.4 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- Weaknesses
- CWE-79
Description
A Cross-site scripting (XSS) vulnerability in the Blog module - add new topic functionality in Liferay Digital Experience Platform 7.3.10 SP3 allows remote attackers to inject arbitrary JS script or HTML into the name field of newly created topic.
Affected configurations
• liferay dxp 7.3
• liferay liferay portal (>= 7.3.0 <= 7.4.0)
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://drive.proton.me/urls/D27RQ14NGW#b71d8XrBl2Mu Third Party Advisory
- https://www.offensity.com/en/blog/authenticated-persistent-xss-in-liferay-dxp-cms-cve-2022-38901-and-cve-2022-38902/ Exploit, Patch, Third Party Advisory
- https://drive.proton.me/urls/D27RQ14NGW#b71d8XrBl2Mu Third Party Advisory
- https://www.offensity.com/en/blog/authenticated-persistent-xss-in-liferay-dxp-cms-cve-2022-38901-and-cve-2022-38902/ Exploit, Patch, Third Party Advisory