CVE-2022-28980

published 2022-09-22

CVE-2022-28980: Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal v7.4.3.4 and Liferay DXP v7.4 GA allows attackers to execute arbitrary web scripts or…

medium 6.1 CVSS 3.1

AV N AC L PR N UI R S C C L I L A N

Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal v7.4.3.4 and Liferay DXP v7.4 GA allows attackers to execute arbitrary web scripts or HTML via parameters with the filter_ prefix.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
liferay	dxp	—	—
liferay	liferay_portal	< 7.4.3.5	7.4.3.5

CWE-79