CVE-2022-26597
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk48th percentile - higher than 48% of all known CVEs
Summary
Cross-site scripting (XSS) vulnerability in the Layout module's Open Graph integration in Liferay Portal 7.3.0 through 7.4.0, and Liferay DXP 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the site name.
Risk Assessment
An attacker can steal user sessions, redirect users to malicious sites, or perform other actions in their context, compromising data confidentiality and integrity.
Recommendation
Immediately update Liferay Portal to version 7.4.1 or later, and for Liferay DXP 7.3 apply service pack 3.
Original NVD description (English source)
Cross-site scripting (XSS) vulnerability in the Layout module's Open Graph integration in Liferay Portal 7.3.0 through 7.4.0, and Liferay DXP 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the site name.