CVE-2022-28980 — Cross-site Scripting in Portal

CWE-79 — Cross-site Scripting4 documents4 sources
Severity
6.1MEDIUMNVD
EPSS
0.2%
top 51.94%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Liferay PortalLiferay DXP
Timeline
PublishedSep 22
Latest updateSep 23

Description

Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal v7.4.3.4 and Liferay DXP v7.4 GA allows attackers to execute arbitrary web scripts or HTML via parameters with the filter_ prefix.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages2 packages

▶NVDliferay/liferay_portal< 7.4.3.5
▶NVDliferay/dxp7.4

🔴Vulnerability Details

3
OSV
Liferay Portal and Liferay DXP Vulnerable to XSS via the filter_ Prefix↗2022-09-23
▶
GHSA
Liferay Portal and Liferay DXP Vulnerable to XSS via the filter_ Prefix↗2022-09-23
▶
CVEList
CVE-2022-28980: Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal v7↗2022-09-22
▶
CVE-2022-28980 — Cross-site Scripting in Liferay Portal | cvebase