CVE-2022-26593

2022-04-1913:15:08

Google

osv.dev

5.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

29.3%

JSON

Cross-site scripting (XSS) vulnerability in the Asset module’s asset categories selector in Liferay Portal 7.3.3 through 7.4.0, and Liferay DXP 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the name of a asset category.

CPENameOperatorVersion
liferay-portaleq7.3.4-ga5
liferay-portaleq7.3.6-ga7
liferay-portaleq7.3.3-ga4
liferay-portaleqtest-fix-pack-base-7310

Name	Operator	Version
liferay-portal	eq	7.3.4-ga5
liferay-portal	eq	7.3.6-ga7
liferay-portal	eq	7.3.3-ga4
liferay-portal	eq	test-fix-pack-base-7310

References

liferay.com

portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-26593-stored-xss-with-category-name-in-asset-categories-selector