CVE-2022-26594: XSS
Multiple cross-site scripting (XSS) vulnerabilities in Dynamic Data Mapping Form Field Type before 6.0.11 from Liferay Portal 7.3.5 through 7.4.0, and Liferay DXP 7.3 before service pack 3 allow remote attackers to inject arbitrary web script or HTML via a form field's help text to (1) Forms module's form builder, or (2) App Builder module's object form view's form builder.
Other sources
Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.3.5 through 7.4.0, and Liferay DXP 7.3 before service pack 3 allow remote attackers to inject arbitrary web script or HTML via a form field's help text to (1) Forms module's form builder, or (2) App Builder module's object form view's form builder.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/com.liferay.portal:release.dxp.bomto a version that resolves this vulnerability.Fixed in 7.3.10.fp3 - Upgrade
Upgrade
maven/com.liferay:com.liferay.dynamic.data.mapping.form.field.typeto a version that resolves this vulnerability.Fixed in 6.0.11
Event History
Frequently Asked Questions
What is the severity of CVE-2022-26594?
CVE-2022-26594 is considered a medium severity vulnerability due to its potential for remote exploitation through cross-site scripting.
How do I fix CVE-2022-26594?
To fix CVE-2022-26594, you should update Liferay Portal to versions 7.4.1 or later or apply the relevant patches provided by Liferay.
Which software versions are affected by CVE-2022-26594?
CVE-2022-26594 affects Liferay Portal versions 7.3.5 to 7.3.7 and Liferay DXP 7.3 before service pack 3.
What are the risks associated with CVE-2022-26594?
The risks associated with CVE-2022-26594 include the possibility for attackers to inject arbitrary web scripts or HTML, potentially leading to session hijacking or data exposure.
Is CVE-2022-26594 a widespread issue?
CVE-2022-26594 is a known vulnerability and should be addressed promptly, especially for organizations using affected versions of Liferay.