CVE-2022-26597

published 2022-04-25

CVE-2022-26597: Cross-site scripting (XSS) vulnerability in the Layout module's Open Graph integration in Liferay Portal 7.3.0 through 7.4.0, and Liferay DXP 7.3 before…

medium 6.1 CVSS 3.1

AV N AC L PR N UI R S C C L I L A N

Cross-site scripting (XSS) vulnerability in the Layout module's Open Graph integration in Liferay Portal 7.3.0 through 7.4.0, and Liferay DXP 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the site name.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
liferay	digital_experience_platform	< 7.3	7.3
liferay	digital_experience_platform	—	—
liferay	liferay_portal	7.3.0 – 7.4.0	—

CWE-79