medium5.4
CVE-2022-38901
A Cross-site scripting (XSS) vulnerability in the Document and Media module - file upload functionality in Liferay Digital Experience Platform 7.3.10 SP3 allow…
Impact
A Cross-site scripting (XSS) vulnerability in the Document and Media module - file upload functionality in Liferay Digital Experience Platform 7.3.10 SP3 allows remote attackers to inject arbitrary JS script or HTML into the description field of uploaded svg file.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Liferay | Dxp | from 7.0 before 7.3 Versions 7.3, 7.4 |
| Liferay | Liferay Portal | from 7.3.5 through 7.4.3.28 |
Weakness classification
References
- NVD record
- CVE.org record
- https://drive.proton.me/urls/D27RQ14NGW#b71d8XrBl2Mu
- https://www.offensity.com/en/blog/authenticated-persistent-xss-in-liferay-dxp-cms-cve-2022-38901-and-cve-2022-38902/
- https://drive.proton.me/urls/D27RQ14NGW#b71d8XrBl2Mu
- https://www.offensity.com/en/blog/authenticated-persistent-xss-in-liferay-dxp-cms-cve-2022-38901-and-cve-2022-38902/