CVE-2022-38901

Published: Oct 19, 2022Modified: Jul 9, 2026

5.4

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.3 / Impact: 2.7

Source: NVD

Description

A Cross-site scripting (XSS) vulnerability in the Document and Media module - file upload functionality in Liferay Digital Experience Platform 7.3.10 SP3 allows remote attackers to inject arbitrary JS script or HTML into the description field of uploaded svg file.

Affected (36)

Products: Liferay: Dxp, Liferay Portal

Liferay

2 products

Dxp

Liferay Portal

Configuration A

36 vulnerable

Vulnerable Software	Affected Versions
Liferay Dxp	From 7.0 to 7.3
Liferay Dxp	Version 7.3
Liferay Dxp	Version 7.3 update_1
Liferay Dxp	Version 7.3 update_2
Liferay Dxp	Version 7.3 update_3
Liferay Dxp	Version 7.3 update_4
Liferay Dxp	Version 7.3 update_5
Liferay Dxp	Version 7.4 update_10
Liferay Dxp	Version 7.4 update_11
Liferay Dxp	Version 7.4 update_12
Liferay Dxp	Version 7.4 update_13
Liferay Dxp	Version 7.4 update_14
Liferay Dxp	Version 7.4 update_15
Liferay Dxp	Version 7.4 update_16
Liferay Dxp	Version 7.4 update_17
Liferay Dxp	Version 7.4 update_18
Liferay Dxp	Version 7.4 update_19
Liferay Dxp	Version 7.4 update_1
Liferay Dxp	Version 7.4 update_20
Liferay Dxp	Version 7.4 update_21
Liferay Dxp	Version 7.4 update_22
Liferay Dxp	Version 7.4 update_23
Liferay Dxp	Version 7.4 update_24
Liferay Dxp	Version 7.4 update_25
Liferay Dxp	Version 7.4 update_26
Liferay Dxp	Version 7.4 update_27
Liferay Dxp	Version 7.4 update_28
Liferay Dxp	Version 7.4 update_2
Liferay Dxp	Version 7.4 update_3
Liferay Dxp	Version 7.4 update_4
Liferay Dxp	Version 7.4 update_5
Liferay Dxp	Version 7.4 update_6
Liferay Dxp	Version 7.4 update_7
Liferay Dxp	Version 7.4 update_8
Liferay Dxp	Version 7.4 update_9
Liferay Liferay Portal	From 7.3.5 to 7.4.3.28