Cross-site scripting (XSS) vulnerability in Journal module's web content display configuration page in Liferay Portal 7.1.0 through 7.3.3, and Liferay DXP 7.0 before fix pack 94, 7.1 before fix pack 19, and 7.2 before fix pack 8, allows remote attackers to inject arbitrary web script or HTML via web content template names.
References
Link | Resource |
---|---|
http://liferay.com | Vendor Advisory |
http://liferay.com | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 06:54
Type | Values Removed | Values Added |
---|---|---|
References | () http://liferay.comĀ - Vendor Advisory |
Information
Published : 2022-04-25 16:16
Updated : 2024-11-21 06:54
NVD link : CVE-2022-26596
Mitre link : CVE-2022-26596
CVE.ORG link : CVE-2022-26596
JSON object : View
Products Affected
liferay
- liferay_portal
- digital_experience_platform
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')