CVE-2022-38902

2022-10-1313:15:10

Google

osv.dev

5.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

31.3%

JSON

A Cross-site scripting (XSS) vulnerability in the Blog module - add new topic functionality in Liferay Digital Experience Platform 7.3.10 SP3 allows remote attackers to inject arbitrary JS script or HTML into the name field of newly created topic.

CPENameOperatorVersion
liferay-portaleq7.3.1-ga2
liferay-portaleq7.3.0-ga1
liferay-portaleq7.3.2-ga3

Name	Operator	Version
liferay-portal	eq	7.3.1-ga2
liferay-portal	eq	7.3.0-ga1
liferay-portal	eq	7.3.2-ga3

References

liferay.com

drive.proton.me/urls/D27RQ14NGW#b71d8XrBl2Mu

www.offensity.com/en/blog/authenticated-persistent-xss-in-liferay-dxp-cms-cve-2022-38901-and-cve-2022-38902/