CVE-2022-38901

MEDIUM

Liferay Digital Experience Platform 7.3.10 SP3 - XSS

Title source: llm
STIX 2.1

Description

A Cross-site scripting (XSS) vulnerability in the Document and Media module - file upload functionality in Liferay Digital Experience Platform 7.3.10 SP3 allows remote attackers to inject arbitrary JS script or HTML into the description field of uploaded svg file.

References (3)

Core 3

Scores

CVSS v3 5.4
EPSS 0.0031
EPSS Percentile 54.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (4)
liferay/dxp 7.3 (6 CPE variants)
liferay/dxp 7.4 update_1 (28 CPE variants)
liferay/dxp 7.0 - 7.3
liferay/liferay_portal 7.3.5 - 7.4.3.28
Published Oct 19, 2022
Tracked Since Feb 18, 2026