PT-2022-17950 · Liferay · Liferay Portal+1

Published 2022-04-25 · Updated 2024-01-31 · CVE-2022-26597

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.3.0 through 7.4.0 Liferay DXP 7.3 before service pack 3

Description A cross-site scripting (XSS) issue exists in the Layout module's Open Graph integration, allowing remote attackers to inject arbitrary web script or HTML via the site name. This enables attackers to potentially execute malicious scripts on the victim's browser.

Recommendations For Liferay Portal versions 7.3.0 through 7.4.0, consider updating to a version outside of this range or applying a service pack that includes the fix for this issue. For Liferay DXP 7.3 before service pack 3, apply service pack 3 or later to resolve the issue. As a temporary workaround, consider restricting access to the Layout module's Open Graph integration until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-LIFERAY-2022-26597

CVE-2022-26597

GHSA-3VWW-JRMM-9VFF

Affected Products

Liferay Dxp

Liferay Portal

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2022-26597 · Security Note
• https://osv.dev/vulnerability/GHSA-3vww-jrmm-9vff · Vendor Advisory
• http://liferay.com · Vendor Advisory
• https://osv.dev/vulnerability/BIT-liferay-2022-26597 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-26597 · Vendor Advisory
• https://github.com/liferay/liferay-portal · Note
• https://github.com/liferay/liferay-portal/commit/fd7fc6e186b36944b045e0fdf368e588889c3f02 · Note
• https://liferay.atlassian.net/browse/LPE-17282 · Note
• https://t.me/cibsecurity/41392 · Telegram Post
• https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2022-26597-stored-xss-with-site-name-in-open-graph-integration?p_r_p_assetEntryId=121612214&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121612214%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse · Note
• https://t.me/cvenotify/29789 · Telegram Post