Cross site scripting

2022-09-2200:15:00

PRIOn knowledge base

www.prio-n.com

0.001 Low

EPSS

Percentile

33.6%

JSON

A cross-site scripting (XSS) vulnerability in Liferay Portal v7.3.3 through v7.4.2 and Liferay DXP v7.3 before service pack 3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the name of a tag.

CPENameOperatorVersion
dxpeq7.3
dxpeq7.3 sp1
dxpeq7.3 sp2
dxpeq7.3 sp3
liferay_portalge7.3.3
liferay_portallt7.4.3.4

Name	Operator	Version
dxp	eq	7.3
dxp	eq	7.3 sp1
dxp	eq	7.3 sp2
dxp	eq	7.3 sp3
liferay_portal	ge	7.3.3
liferay_portal	lt	7.4.3.4

References

liferay.com

portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-28982-reflected-xss-with-tag-name-in-%253Cliferay-asset-asset-tags-selector%253E

0.001 Low

EPSS

Percentile

33.6%

JSON

Related for PRION:CVE-2022-28982