Liferay Portal and Liferay DXP Vulnerable to XSS via Tag Name

MEDIO 6.1CVE-2022-28982 · GHSA-wffm-j7m8-93g4 · Published 22/09/2022 · updated 09/07/2026

In breve

CVE-2022-28982 è una vulnerabilità MEDIO (CVSS 6.1) che riguarda com.liferay:com.liferay.asset.taglib, dxp (liferay), liferay portal (liferay).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.45%, superiore al 38.9% delle vulnerabilità.
Correzione: aggiornare a 6.1.9, 7.4.3.4 o successiva.

Package	Affected versions	Patched versions
com.liferay:com.liferay.asset.taglib Maven	`< 6.1.9`	`6.1.9`
dxp liferay	`= 7.3`	No fix yet
liferay portal liferay	`≥ 7.3.3, < 7.4.3.4`	`7.4.3.4`

Description

A cross-site scripting (XSS) vulnerability in Liferay Asset Taglib before v6.1.9 from Liferay Portal (v7.3.3 through v7.4.2) and Liferay DXP v7.3 before service pack 3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the name of a tag.

NVD description

A cross-site scripting (XSS) vulnerability in Liferay Portal v7.3.3 through v7.4.2 and Liferay DXP v7.3 before service pack 3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the name of a tag.

References

Altre vulnerabilità di com.liferay:com.liferay.asset.taglib

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free