CVE-2022-28980

MediumCVSS 6.1

Published: 22/09/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.36%

28th percentile - higher than 28% of all known CVEs

Summary

Multiple cross-site scripting (XSS) vulnerabilities were found in Liferay Portal v7.4.3.4 and Liferay DXP v7.4 GA. Attackers can execute arbitrary web scripts or HTML via parameters with the "filter_" prefix.

Risk Assessment

The risk includes potential session hijacking, admin account takeover, or distribution of malicious code within the organization, leading to data confidentiality and integrity breaches.

Recommendation

Immediately upgrade Liferay Portal to a version later than 7.4.3.4 and Liferay DXP to a version later than 7.4 GA, and implement input filtering for parameters with the "filter_" prefix.

Original NVD description (English source)

Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal v7.4.3.4 and Liferay DXP v7.4 GA allows attackers to execute arbitrary web scripts or HTML via parameters with the filter_ prefix.