← Back

CVE-2022-28978

nvd nist
Published: Sep 22, 2022Modified: May 27, 2025

JSON object

Loading...
5.4
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Exploitability: 2.3 / Impact: 2.7
Source: NVD

Description

Stored cross-site scripting (XSS) vulnerability in the Site module's user membership administration page in Liferay Portal 7.0.1 through 7.4.1, and Liferay DXP 7.0 before fix pack 102, 7.1 before fix pack 26, 7.2 before fix pack 15, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the a user's name.

Affected (116)

Liferay
3 products
Digital Experience Platform
Dxp
Liferay Portal
Configuration A
116 vulnerable
Vulnerable SoftwareAffected Versions
Liferay
Digital Experience Platform
Version 7.0
Digital Experience Platform
Version 7.0 fix_pack_100
Digital Experience Platform
Version 7.0 fix_pack_101
Digital Experience Platform
Version 7.0 fix_pack_13
Digital Experience Platform
Version 7.0 fix_pack_14
Digital Experience Platform
Version 7.0 fix_pack_24
Digital Experience Platform
Version 7.0 fix_pack_25
Digital Experience Platform
Version 7.0 fix_pack_26
Digital Experience Platform
Version 7.0 fix_pack_27
Digital Experience Platform
Version 7.0 fix_pack_28
Digital Experience Platform
Version 7.0 fix_pack_30
Digital Experience Platform
Version 7.0 fix_pack_33
Digital Experience Platform
Version 7.0 fix_pack_35
Digital Experience Platform
Version 7.0 fix_pack_36
Digital Experience Platform
Version 7.0 fix_pack_39
Digital Experience Platform
Version 7.0 fix_pack_40
Digital Experience Platform
Version 7.0 fix_pack_41
Digital Experience Platform
Version 7.0 fix_pack_42
Digital Experience Platform
Version 7.0 fix_pack_43
Digital Experience Platform
Version 7.0 fix_pack_44
Digital Experience Platform
Version 7.0 fix_pack_45
Digital Experience Platform
Version 7.0 fix_pack_46
Digital Experience Platform
Version 7.0 fix_pack_47
Digital Experience Platform
Version 7.0 fix_pack_48
Digital Experience Platform
Version 7.0 fix_pack_49
Digital Experience Platform
Version 7.0 fix_pack_50
Digital Experience Platform
Version 7.0 fix_pack_51
Digital Experience Platform
Version 7.0 fix_pack_52
Digital Experience Platform
Version 7.0 fix_pack_53
Digital Experience Platform
Version 7.0 fix_pack_54
Digital Experience Platform
Version 7.0 fix_pack_56
Digital Experience Platform
Version 7.0 fix_pack_57
Digital Experience Platform
Version 7.0 fix_pack_58
Digital Experience Platform
Version 7.0 fix_pack_59
Digital Experience Platform
Version 7.0 fix_pack_60
Digital Experience Platform
Version 7.0 fix_pack_61
Digital Experience Platform
Version 7.0 fix_pack_64
Digital Experience Platform
Version 7.0 fix_pack_65
Digital Experience Platform
Version 7.0 fix_pack_66
Digital Experience Platform
Version 7.0 fix_pack_67
Digital Experience Platform
Version 7.0 fix_pack_68
Digital Experience Platform
Version 7.0 fix_pack_69
Digital Experience Platform
Version 7.0 fix_pack_70
Digital Experience Platform
Version 7.0 fix_pack_71
Digital Experience Platform
Version 7.0 fix_pack_72
Digital Experience Platform
Version 7.0 fix_pack_73
Digital Experience Platform
Version 7.0 fix_pack_75
Digital Experience Platform
Version 7.0 fix_pack_76
Digital Experience Platform
Version 7.0 fix_pack_78
Digital Experience Platform
Version 7.0 fix_pack_79
Digital Experience Platform
Version 7.0 fix_pack_80
Digital Experience Platform
Version 7.0 fix_pack_81
Digital Experience Platform
Version 7.0 fix_pack_82
Digital Experience Platform
Version 7.0 fix_pack_83
Digital Experience Platform
Version 7.0 fix_pack_84
Digital Experience Platform
Version 7.0 fix_pack_85
Digital Experience Platform
Version 7.0 fix_pack_86
Digital Experience Platform
Version 7.0 fix_pack_87
Digital Experience Platform
Version 7.0 fix_pack_88
Digital Experience Platform
Version 7.0 fix_pack_89
Digital Experience Platform
Version 7.0 fix_pack_90
Digital Experience Platform
Version 7.0 fix_pack_91
Digital Experience Platform
Version 7.0 fix_pack_92
Digital Experience Platform
Version 7.0 fix_pack_93
Digital Experience Platform
Version 7.0 fix_pack_94
Digital Experience Platform
Version 7.0 fix_pack_95
Digital Experience Platform
Version 7.0 fix_pack_96
Digital Experience Platform
Version 7.0 fix_pack_97
Digital Experience Platform
Version 7.0 fix_pack_98
Digital Experience Platform
Version 7.0 fix_pack_99
Digital Experience Platform
Version 7.1
Digital Experience Platform
Version 7.1 fix_pack_10
Digital Experience Platform
Version 7.1 fix_pack_11
Digital Experience Platform
Version 7.1 fix_pack_12
Digital Experience Platform
Version 7.1 fix_pack_13
Digital Experience Platform
Version 7.1 fix_pack_14
Digital Experience Platform
Version 7.1 fix_pack_15
Digital Experience Platform
Version 7.1 fix_pack_16
Digital Experience Platform
Version 7.1 fix_pack_17
Digital Experience Platform
Version 7.1 fix_pack_18
Digital Experience Platform
Version 7.1 fix_pack_19
Digital Experience Platform
Version 7.1 fix_pack_1
Digital Experience Platform
Version 7.1 fix_pack_20
Digital Experience Platform
Version 7.1 fix_pack_21
Digital Experience Platform
Version 7.1 fix_pack_22
Digital Experience Platform
Version 7.1 fix_pack_23
Digital Experience Platform
Version 7.1 fix_pack_24
Digital Experience Platform
Version 7.1 fix_pack_25
Digital Experience Platform
Version 7.1 fix_pack_2
Digital Experience Platform
Version 7.1 fix_pack_3
Digital Experience Platform
Version 7.1 fix_pack_4
Digital Experience Platform
Version 7.1 fix_pack_5
Digital Experience Platform
Version 7.1 fix_pack_6
Digital Experience Platform
Version 7.1 fix_pack_7
Digital Experience Platform
Version 7.1 fix_pack_8
Digital Experience Platform
Version 7.1 fix_pack_9
Digital Experience Platform
Version 7.2
Digital Experience Platform
Version 7.2 fix_pack_10
Digital Experience Platform
Version 7.2 fix_pack_11
Digital Experience Platform
Version 7.2 fix_pack_12
Digital Experience Platform
Version 7.2 fix_pack_13
Digital Experience Platform
Version 7.2 fix_pack_14
Digital Experience Platform
Version 7.2 fix_pack_1
Digital Experience Platform
Version 7.2 fix_pack_2
Digital Experience Platform
Version 7.2 fix_pack_3
Digital Experience Platform
Version 7.2 fix_pack_4
Digital Experience Platform
Version 7.2 fix_pack_5
Digital Experience Platform
Version 7.2 fix_pack_6
Digital Experience Platform
Version 7.2 fix_pack_7
Digital Experience Platform
Version 7.2 fix_pack_8
Digital Experience Platform
Version 7.2 fix_pack_9
Liferay
Dxp
Version 7.3
Dxp
Version 7.3 sp1
Dxp
Version 7.3 sp2
Dxp
Version 7.3 sp3
Liferay Portal
From 7.0.1 to 7.4.2

Related CWEs

CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (4)

Source: cve@mitre.org
Product
Source: cve@mitre.org
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Product
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory

Timeline

No history available yet.