PT-2022-24615 · Liferay · Liferay Digital Experience Platform

Rafal Lykowski · Published 2022-10-13 · Updated 2025-05-15 · CVE-2022-38902

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Liferay Digital Experience Platform version 7.3.10 SP3

Description A Cross-site scripting (XSS) issue in the Blog module's add new topic functionality allows remote attackers to inject arbitrary JS script or HTML into the name field of newly created topics.

Recommendations For Liferay Digital Experience Platform version 7.3.10 SP3, consider restricting access to the Blog module's add new topic functionality until a fix is available. As a temporary workaround, restrict the ability to inject arbitrary JS script or HTML into the name field of newly created topics.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-38902

Affected Products

Liferay Digital Experience Platform

References · 7

• 🔥 https://offensity.com/en/blog/authenticated-persistent-xss-in-liferay-dxp-cms-cve-2022-38901-and-cve-2022-38902 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-38902 · Security Note
• https://osv.dev/vulnerability/CVE-2022-38902 · Vendor Advisory
• https://drive.proton.me/urls/D27RQ14NGW#b71d8XrBl2Mu · Note
• http://liferay.com · Note
• https://t.me/cvenotify/122351 · Telegram Post
• https://t.me/cibsecurity/51314 · Telegram Post