CVE-2022-26594

MediumCVSS 6.1

Published: 15/04/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.70%

49th percentile - higher than 49% of all known CVEs

Summary

Multiple XSS vulnerabilities were found in Liferay Portal 7.3.5 through 7.4.0 and Liferay DXP 7.3 before service pack 3. An attacker can inject arbitrary script or HTML via form field help text in the Forms module or App Builder module.

Risk Assessment

The risk involves execution of malicious scripts in users' browsers, potentially leading to session hijacking, defacement, or data theft.

Recommendation

Immediately upgrade Liferay Portal to version 7.4.1 or later, and Liferay DXP 7.3 to service pack 3 or later.

Original NVD description (English source)

Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.3.5 through 7.4.0, and Liferay DXP 7.3 before service pack 3 allow remote attackers to inject arbitrary web script or HTML via a form field's help text to (1) Forms module's form builder, or (2) App Builder module's object form view's form builder.