Liferay Portal and Liferay DXP Vulnerable to XSS via Tag Name

MOYENNE 6.1CVE-2022-28982 · GHSA-wffm-j7m8-93g4 · Published 22/09/2022 · updated 09/07/2026

En bref

CVE-2022-28982 est une vulnérabilité MOYENNE (CVSS 6.1) touchant com.liferay:com.liferay.asset.taglib, dxp (liferay), liferay portal (liferay).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.45%, plus élevée que 38.9% des vulnérabilités.
Correctif : mettre à jour vers 6.1.9, 7.4.3.4 ou plus récent.

Package	Affected versions	Patched versions
com.liferay:com.liferay.asset.taglib Maven	`< 6.1.9`	`6.1.9`
dxp liferay	`= 7.3`	No fix yet
liferay portal liferay	`≥ 7.3.3, < 7.4.3.4`	`7.4.3.4`

Description

A cross-site scripting (XSS) vulnerability in Liferay Asset Taglib before v6.1.9 from Liferay Portal (v7.3.3 through v7.4.2) and Liferay DXP v7.3 before service pack 3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the name of a tag.

NVD description

A cross-site scripting (XSS) vulnerability in Liferay Portal v7.3.3 through v7.4.2 and Liferay DXP v7.3 before service pack 3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the name of a tag.

References

Autres vulnérabilités de com.liferay:com.liferay.asset.taglib

Tout voir →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free