CVE-2022-26593

MediumCVSS 5.4

Published: 19/04/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.56%

42th percentile - higher than 42% of all known CVEs

Summary

Cross-site scripting (XSS) vulnerability in the Asset module's asset categories selector in Liferay Portal 7.3.3 through 7.4.0, and Liferay DXP 7.3 before Service Pack 3. Remote attackers can inject arbitrary web script or HTML via the name of an asset category.

Risk Assessment

Risk of session hijacking, account takeover, or unauthorized actions performed in the victim's browser context.

Recommendation

Upgrade Liferay Portal to version 7.4.1 or later, and Liferay DXP 7.3 to Service Pack 3 or later.

Original NVD description (English source)

Cross-site scripting (XSS) vulnerability in the Asset module's asset categories selector in Liferay Portal 7.3.3 through 7.4.0, and Liferay DXP 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the name of a asset category.