PT-2022-17947 · Liferay · Liferay Portal+1

Duy Huynh · Published 2022-04-15 · Updated 2022-04-22 · CVE-2022-26594

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.3.5 through 7.4.0 Liferay DXP versions 7.3 before service pack 3

Description Multiple cross-site scripting (XSS) vulnerabilities allow remote attackers to inject arbitrary web script or HTML via a form field's help text to the Forms module's form builder or the App Builder module's object form view's form builder.

Recommendations For Liferay Portal versions 7.3.5 through 7.4.0, consider disabling the form builder in the Forms module and the object form view's form builder in the App Builder module until a patch is available. For Liferay DXP versions 7.3 before service pack 3, consider disabling the form builder in the Forms module and the object form view's form builder in the App Builder module until a patch is available. Restrict access to the form field's help text in the affected modules to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-26594

GHSA-658F-XHV4-P978

Affected Products

Liferay Dxp

Liferay Portal

References · 11

• https://osv.dev/vulnerability/CVE-2022-26594 · Vendor Advisory
• https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-26594-xss-vulnerability-with-form-field-help-text · Vendor Advisory
• http://liferay.com · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-26594 · Security Note
• https://osv.dev/vulnerability/GHSA-658f-xhv4-p978 · Vendor Advisory
• https://github.com/liferay/liferay-portal · Note
• https://github.com/liferay/liferay-portal/commit/7c9348cc59271647cfd192c007d383d80ae9a667 · Note
• https://t.me/cibsecurity/40882 · Telegram Post
• https://liferay.atlassian.net/browse/LPE-17290 · Note
• https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2022-26594-xss-vulnerability-with-form-field-help-text?p_r_p_assetEntryId=121612173&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121612173%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse · Note
• https://t.me/cvenotify/29020 · Telegram Post