CVE-2022-38902

MEDIUM

Liferay Digital Experience Platform 7.3.10 SP3 - XSS

Title source: llm
STIX 2.1

Description

A Cross-site scripting (XSS) vulnerability in the Blog module - add new topic functionality in Liferay Digital Experience Platform 7.3.10 SP3 allows remote attackers to inject arbitrary JS script or HTML into the name field of newly created topic.

References (3)

Core 3

Scores

CVSS v3 5.4
EPSS 0.0023
EPSS Percentile 45.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (2)
liferay/dxp 7.3 (12 CPE variants)
liferay/liferay_portal 7.3.0 - 7.4.0
Published Oct 13, 2022
Tracked Since Feb 18, 2026