Liferay Portal and Liferay DXP Vulnerable to XSS in the Site Module

🗓️ 23 Sep 2022 00:00:46Reported by GitHub Advisory DatabaseType

Liferay Portal and DXP have a stored XSS vulnerability in the Site module allowing remote injection.

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2022-28978	22 Sep 202207:11	–	circl
CNNVD	Liferay Portal和Liferay DXP 跨站脚本漏洞	21 Sep 202200:00	–	cnnvd
CVE	CVE-2022-28978	21 Sep 202223:38	–	cve
Cvelist	CVE-2022-28978	21 Sep 202223:38	–	cvelist
EUVD	EUVD-2022-33409	3 Oct 202520:07	–	euvd
NVD	CVE-2022-28978	22 Sep 202200:15	–	nvd
OSV	GHSA-7M65-HMVG-RXPC Liferay Portal and Liferay DXP Vulnerable to XSS in the Site Module	23 Sep 202200:00	–	osv
Prion	Cross site scripting	22 Sep 202200:15	–	prion
Positive Technologies	PT-2022-19338 · Liferay · Liferay Dxp +1	21 Sep 202200:00	–	ptsecurity
RedhatCVE	CVE-2022-28978	23 May 202501:04	–	redhatcve

Vulners

Node

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2022-28978
liferay	www.liferay.com/
github	www.github.com/liferay/liferay-portal/commit/ffdc9d1f8abf484598afdc51671a30533740c16d
liferay	www.liferay.atlassian.net/browse/LPE-17332
liferay	www.liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2022-28978-stored-xss-with-user-name-in-site-membership
web	www.web.archive.org/web/20220922015759/https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-28978-stored-xss-with-user-name-in-site-membership
github	www.github.com/advisories/GHSA-7m65-hmvg-rxpc

16 Jul 2025 14:52Current

5.2Medium risk

Vulners AI Score5.2

CVSS 3.15.4

EPSS0.00522

SSVC