Cross-site Scripting Vulnerability in Liferay Portal and DXP
CVE-2022-26596

6.1MEDIUM

Key Information:

Vendor

Liferay
Status
Digital Experience Platform
Liferay Portal
Vendor
CVE Published:
25 April 2022

What is CVE-2022-26596?

The cross-site scripting vulnerability present in Liferay Portal's Journal module allows remote attackers to inject arbitrary web scripts or HTML through the manipulation of web content template names. This issue affects various versions of Liferay Portal from 7.1.0 to 7.3.3 and Liferay DXP 7.0 before fix pack 94, 7.1 before fix pack 19, and 7.2 before fix pack 8. It poses a significant security risk to the affected products, enabling unauthorized attackers to execute malicious scripts in users' browsers.

References

http://liferay.com
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2022-26596 : Cross-site Scripting Vulnerability in Liferay Portal and DXP