A Cross-site scripting (XSS) vulnerability in the Document and Media module - file upload functionality in Liferay Digital Experience Platform 7.3.10 SP3 allows remote attackers to inject arbitrary JS script or HTML into the description field of uploaded svg file.
References
Link | Resource |
---|---|
http://liferay.com | Vendor Advisory |
https://drive.proton.me/urls/D27RQ14NGW#b71d8XrBl2Mu | Third Party Advisory |
https://www.offensity.com/en/blog/authenticated-persistent-xss-in-liferay-dxp-cms-cve-2022-38901-and-cve-2022-38902/ | Exploit Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
No history.
Information
Published : 2022-10-19 02:15
Updated : 2024-02-28 19:29
NVD link : CVE-2022-38901
Mitre link : CVE-2022-38901
CVE.ORG link : CVE-2022-38901
JSON object : View
Products Affected
liferay
- dxp
- liferay_portal
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')