CVE-2022-28979

MediumCVSS 6.1

Published: 22/09/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.39%

31th percentile - higher than 31% of all known CVEs

Summary

Liferay Portal versions 7.1.0 through 7.4.2 and Liferay DXP 7.1 before fix pack 26, 7.2 before fix pack 15, and 7.3 before service pack 3 contain a cross-site scripting (XSS) vulnerability in the Custom Facet widget of the Portal Search module. Attackers can inject arbitrary JavaScript or HTML via the Custom Parameter Name text field.

Risk Assessment

The risk involves the execution of arbitrary scripts in the victim's browser, potentially leading to session hijacking, account takeover, or sensitive data leakage within the organization.

Recommendation

Immediately update Liferay Portal to version 7.4.3 or later, and for Liferay DXP apply the relevant fixes: fix pack 26 for 7.1, fix pack 15 for 7.2, or service pack 3 for 7.3.

Original NVD description (English source)

Liferay Portal v7.1.0 through v7.4.2 and Liferay DXP 7.1 before fix pack 26, 7.2 before fix pack 15, and 7.3 before service pack 3 was discovered to contain a cross-site scripting (XSS) vulnerability in the Portal Search module's Custom Facet widget. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Custom Parameter Name text field.