PT-2022-24614 · Liferay · Liferay Digital Experience Platform

Rafal Lykowski · Published 2022-10-19 · Updated 2025-05-09 · CVE-2022-38901

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Liferay Digital Experience Platform version 7.3.10 SP3

Description A Cross-site scripting (XSS) issue exists in the file upload functionality of the Document and Media module, allowing remote attackers to inject arbitrary JS script or HTML into the description field of uploaded svg files.

Recommendations For Liferay Digital Experience Platform version 7.3.10 SP3, consider restricting access to the file upload functionality in the Document and Media module until a fix is available, and avoid using the description field for uploaded svg files to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-38901

Affected Products

Liferay Digital Experience Platform

References · 6

• 🔥 https://offensity.com/en/blog/authenticated-persistent-xss-in-liferay-dxp-cms-cve-2022-38901-and-cve-2022-38902 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-38901 · Security Note
• https://osv.dev/vulnerability/CVE-2022-38901 · Vendor Advisory
• http://liferay.com · Vendor Advisory
• https://drive.proton.me/urls/D27RQ14NGW#b71d8XrBl2Mu · Note
• https://t.me/cvenotify/121566 · Telegram Post