CVE-2022-38902

Published: Oct 13, 2022Modified: Jul 9, 2026

5.4

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.3 / Impact: 2.7

Source: NVD

Description

A Cross-site scripting (XSS) vulnerability in the Blog module - add new topic functionality in Liferay Digital Experience Platform 7.3.10 SP3 allows remote attackers to inject arbitrary JS script or HTML into the name field of newly created topic.

Affected (13)

Products: Liferay: Dxp, Liferay Portal

Liferay

2 products

Dxp

Liferay Portal

Configuration A

13 vulnerable

Vulnerable Software	Affected Versions
Liferay Dxp	Version 7.3
Liferay Dxp	Version 7.3 sp1
Liferay Dxp	Version 7.3 sp2
Liferay Dxp	Version 7.3 sp3
Liferay Dxp	Version 7.3 update_1
Liferay Dxp	Version 7.3 update_2
Liferay Dxp	Version 7.3 update_3
Liferay Dxp	Version 7.3 update_4
Liferay Dxp	Version 7.3 update_5
Liferay Dxp	Version 7.3 update_6
Liferay Dxp	Version 7.3 update_7
Liferay Dxp	Version 7.3 update_8
Liferay Liferay Portal	From 7.3.0 to 7.4.0