Liferay Portal and Liferay DXP Vulnerable to XSS via the filter_ Prefix

보통 6.1CVE-2022-28980 · GHSA-8mp9-w7gr-pvj3 · Published 22/09/2022 · updated 09/07/2026

요약

CVE-2022-28980은(는) com.liferay.portal:release.dxp.bom, com.liferay:com.liferay.fragment.renderer.collection.filter.impl, dxp (liferay)에 영향을 주는 보통 (CVSS 6.1) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 0.45%, 전체 취약점의 38.9%보다 높음.
조치: 7.4.3.5-ga5, 1.0.11, 7.4.3.5 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
com.liferay.portal:release.dxp.bom Maven	`< 7.4.3.5-ga5`	`7.4.3.5-ga5`
com.liferay:com.liferay.fragment.renderer.collection.filter.impl Maven	`< 1.0.11`	`1.0.11`
dxp liferay	`= 7.4`	No fix yet
liferay portal liferay	`< 7.4.3.5`	`7.4.3.5`

Description

Multiple cross-site scripting (XSS) vulnerabilities in Liferay Fragment Renderer Collection Filter Implementation before v1.0.11 from Liferay Portal (v7.4.3.4) and Liferay DXP v7.4 GA allows attackers to execute arbitrary web scripts or HTML via parameters with the filter_ prefix.

NVD description

Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal v7.4.3.4 and Liferay DXP v7.4 GA allows attackers to execute arbitrary web scripts or HTML via parameters with the filter_ prefix.

References

com.liferay.portal:release.dxp.bom의 다른 취약점

모두 보기 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free