PT-2022-19338 · Liferay · Liferay Portal+1

Published 2022-09-21 · Updated 2022-09-23 · CVE-2022-28978

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.0.1 through 7.4.1 Liferay DXP 7.0 before fix pack 102 Liferay DXP 7.1 before fix pack 26 Liferay DXP 7.2 before fix pack 15 Liferay DXP 7.3 before service pack 3

Description A stored cross-site scripting (XSS) issue in the Site module's user membership administration page allows remote attackers to inject arbitrary web script or HTML via a user's name. This enables attackers to execute malicious scripts on the victim's browser.

Recommendations For Liferay Portal versions 7.0.1 through 7.4.1, update to a version outside of this range or apply the necessary fix pack or service pack. For Liferay DXP 7.0, apply fix pack 102 or later. For Liferay DXP 7.1, apply fix pack 26 or later. For Liferay DXP 7.2, apply fix pack 15 or later. For Liferay DXP 7.3, apply service pack 3 or later. As a temporary workaround, consider restricting user input for names to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-28978

GHSA-7M65-HMVG-RXPC

Affected Products

Liferay Dxp

Liferay Portal

References · 12

• https://osv.dev/vulnerability/GHSA-7m65-hmvg-rxpc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-28978 · Security Note
• https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-28978-stored-xss-with-user-name-in-site-membership · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-28978 · Vendor Advisory
• https://github.com/liferay/liferay-portal · Note
• https://github.com/liferay/liferay-portal/commit/ffdc9d1f8abf484598afdc51671a30533740c16d · Note
• https://t.me/cibsecurity/50253 · Telegram Post
• https://liferay.atlassian.net/browse/LPE-17332 · Note
• https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2022-28978-stored-xss-with-user-name-in-site-membership?p_r_p_assetEntryId=121612301&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121612301%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse · Note
• https://web.archive.org/web/20220922015759/https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-28978-stored-xss-with-user-name-in-site-membership · Note
• https://t.me/cvenotify/36649 · Telegram Post
• http://liferay.com · Note