CVE-2022-38901: XSS
First published: Wed Oct 19 2022(Updated: )
A Cross-site scripting (XSS) vulnerability in the Document and Media module - file upload functionality in Liferay Digital Experience Platform 7.3.10 SP3 allows remote attackers to inject arbitrary JS script or HTML into the description field of uploaded svg file.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Liferay DXP | >=7.0<7.3 | |
| Liferay DXP | =7.3 | |
| Liferay DXP | =7.3-update_1 | |
| Liferay DXP | =7.3-update_2 | |
| Liferay DXP | =7.3-update_3 | |
| Liferay DXP | =7.3-update_4 | |
| Liferay DXP | =7.3-update_5 | |
| Liferay DXP | =7.4-update_1 | |
| Liferay DXP | =7.4-update_10 | |
| Liferay DXP | =7.4-update_11 | |
| Liferay DXP | =7.4-update_12 | |
| Liferay DXP | =7.4-update_13 | |
| Liferay DXP | =7.4-update_14 | |
| Liferay DXP | =7.4-update_15 | |
| Liferay DXP | =7.4-update_16 | |
| Liferay DXP | =7.4-update_17 | |
| Liferay DXP | =7.4-update_18 | |
| Liferay DXP | =7.4-update_19 | |
| Liferay DXP | =7.4-update_2 | |
| Liferay DXP | =7.4-update_20 | |
| Liferay DXP | =7.4-update_21 | |
| Liferay DXP | =7.4-update_22 | |
| Liferay DXP | =7.4-update_23 | |
| Liferay DXP | =7.4-update_24 | |
| Liferay DXP | =7.4-update_25 | |
| Liferay DXP | =7.4-update_26 | |
| Liferay DXP | =7.4-update_27 | |
| Liferay DXP | =7.4-update_28 | |
| Liferay DXP | =7.4-update_3 | |
| Liferay DXP | =7.4-update_4 | |
| Liferay DXP | =7.4-update_5 | |
| Liferay DXP | =7.4-update_6 | |
| Liferay DXP | =7.4-update_7 | |
| Liferay DXP | =7.4-update_8 | |
| Liferay DXP | =7.4-update_9 | |
| Liferay Liferay Portal | >=7.3.5<=7.4.3.28 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2022-38901?
The severity of CVE-2022-38901 is medium with a CVSS score of 5.4.
How does CVE-2022-38901 affect Liferay Digital Experience Platform?
CVE-2022-38901 affects Liferay Digital Experience Platform 7.0 to 7.3.10 SP3.
What is the vulnerability in CVE-2022-38901?
CVE-2022-38901 is a Cross-Site Scripting (XSS) vulnerability in the Document and Media module file upload functionality.
How can remote attackers exploit CVE-2022-38901?
Remote attackers can inject arbitrary JavaScript or HTML into the description field of an uploaded SVG file.
Are there any known fixes for CVE-2022-38901?
Yes, Liferay released updates to address CVE-2022-38901. It is recommended to upgrade to the latest version of Liferay Digital Experience Platform.
- collector/nvd-index
- agent/weakness
- agent/references
- agent/severity
- agent/author
- agent/type
- agent/tags
- agent/event
- agent/description
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- vendor/liferay
- canonical/liferay dxp
- version/liferay dxp/7.0
- version/liferay dxp/7.3
- version/liferay dxp/7.3-update_1
- version/liferay dxp/7.3-update_2
- version/liferay dxp/7.3-update_3
- version/liferay dxp/7.3-update_4
- version/liferay dxp/7.3-update_5
- version/liferay dxp/7.4-update_1
- version/liferay dxp/7.4-update_10
- version/liferay dxp/7.4-update_11
- version/liferay dxp/7.4-update_12
- version/liferay dxp/7.4-update_13
- version/liferay dxp/7.4-update_14
- version/liferay dxp/7.4-update_15
- version/liferay dxp/7.4-update_16
- version/liferay dxp/7.4-update_17
- version/liferay dxp/7.4-update_18
- version/liferay dxp/7.4-update_19
- version/liferay dxp/7.4-update_2
- version/liferay dxp/7.4-update_20
- version/liferay dxp/7.4-update_21
- version/liferay dxp/7.4-update_22
- version/liferay dxp/7.4-update_23
- version/liferay dxp/7.4-update_24
- version/liferay dxp/7.4-update_25
- version/liferay dxp/7.4-update_26
- version/liferay dxp/7.4-update_27
- version/liferay dxp/7.4-update_28
- version/liferay dxp/7.4-update_3
- version/liferay dxp/7.4-update_4
- version/liferay dxp/7.4-update_5
- version/liferay dxp/7.4-update_6
- version/liferay dxp/7.4-update_7
- version/liferay dxp/7.4-update_8
- version/liferay dxp/7.4-update_9
- canonical/liferay liferay portal
- version/liferay liferay portal/7.3.5
- version/liferay liferay portal/7.4.3.28