CVE-2022-28982
published 2022-09-22CVE-2022-28982: A cross-site scripting (XSS) vulnerability in Liferay Portal v7.3.3 through v7.4.2 and Liferay DXP v7.3 before service pack 3 allows attackers to execute…
PriorityP422medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
0.36%
28.7th percentile
A cross-site scripting (XSS) vulnerability in Liferay Portal v7.3.3 through v7.4.2 and Liferay DXP v7.3 before service pack 3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the name of a tag.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| liferay | dxp | — | — |
| liferay | dxp | — | — |
| liferay | dxp | — | — |
| liferay | dxp | — | — |
| liferay | liferay_portal | >= 7.3.3 < 7.4.3.4 | 7.4.3.4 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Liferay Portal and Liferay DXP Vulnerable to XSS via Tag Name
osv·2022-09-23
CVE-2022-28982 [MEDIUM] Liferay Portal and Liferay DXP Vulnerable to XSS via Tag Name
Liferay Portal and Liferay DXP Vulnerable to XSS via Tag Name
A cross-site scripting (XSS) vulnerability in Liferay Asset Taglib before v6.1.9 from Liferay Portal (v7.3.3 through v7.4.2) and Liferay DXP v7.3 before service pack 3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the name of a tag.
GHSA
Liferay Portal and Liferay DXP Vulnerable to XSS via Tag Name
ghsa·2022-09-23
CVE-2022-28982 [MEDIUM] CWE-79 Liferay Portal and Liferay DXP Vulnerable to XSS via Tag Name
Liferay Portal and Liferay DXP Vulnerable to XSS via Tag Name
A cross-site scripting (XSS) vulnerability in Liferay Asset Taglib before v6.1.9 from Liferay Portal (v7.3.3 through v7.4.2) and Liferay DXP v7.3 before service pack 3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the name of a tag.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-28982-reflected-xss-with-tag-name-in-%253Cliferay-asset-asset-tags-selector%253Ehttps://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-28982-reflected-xss-with-tag-name-in-%253Cliferay-asset-asset-tags-selector%253E
2022-09-22
Published