CVE-2022-38902

A Cross-site scripting (XSS) vulnerability in the Blog module - add new topic functionality in Liferay Digital Experience Platform 7.3.10 SP3 allows remote attackers to inject arbitrary JS script or HTML into the name field of newly created topic.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
5.4 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
mitreCNA
---
---
CVEADP
---
---
CISA-ADPADP
5.4 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 24%
VendorProductVersion
liferaydxp
7.3
liferaydxp
7.3:sp1
liferaydxp
7.3:sp2
liferaydxp
7.3:sp3
liferaydxp
7.3:update_1
liferaydxp
7.3:update_2
liferaydxp
7.3:update_3
liferaydxp
7.3:update_4
liferaydxp
7.3:update_5
liferaydxp
7.3:update_6
liferaydxp
7.3:update_7
liferaydxp
7.3:update_8
liferayliferay_portal
7.3.0 ≤
𝑥
≤ 7.4.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://liferay.com
https://drive.proton.me/urls/D27RQ14NGW#b71d8XrBl2Mu
https://www.offensity.com/en/blog/authenticated-persistent-xss-in-liferay-dxp-cms-cve-2022-38901-and-cve-2022-38902/
http://liferay.com
https://drive.proton.me/urls/D27RQ14NGW#b71d8XrBl2Mu
https://www.offensity.com/en/blog/authenticated-persistent-xss-in-liferay-dxp-cms-cve-2022-38901-and-cve-2022-38902/