Cross site scripting

2022-04-1913:15:00

PRIOn knowledge base

www.prio-n.com

0.001 Low

EPSS

Percentile

29.3%

JSON

Cross-site scripting (XSS) vulnerability in the Asset module’s asset categories selector in Liferay Portal 7.3.3 through 7.4.0, and Liferay DXP 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the name of a asset category.

CPENameOperatorVersion
digital_experience_platformeq7.3
digital_experience_platformlt7.3
digital_experience_platformeq7.3 fixpack2
liferay_portaleq7.4.0
liferay_portalge7.3.3
liferay_portallt7.3.7

Name	Operator	Version
digital_experience_platform	eq	7.3
digital_experience_platform	lt	7.3
digital_experience_platform	eq	7.3 fixpack2
liferay_portal	eq	7.4.0
liferay_portal	ge	7.3.3
liferay_portal	lt	7.3.7

References

liferay.com

portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-26593-stored-xss-with-category-name-in-asset-categories-selector

0.001 Low

EPSS

Percentile

29.3%

JSON

Related for PRION:CVE-2022-26593