CVE-2022-28982

MediumCVSS 6.1

Published: 22/09/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.36%

28th percentile - higher than 28% of all known CVEs

Summary

A cross-site scripting (XSS) vulnerability exists in Liferay Portal v7.3.3 through v7.4.2 and Liferay DXP v7.3 before Service Pack 3. Attackers can inject arbitrary web scripts or HTML via a crafted payload in the name of a tag.

Risk Assessment

The risk involves arbitrary script execution in the victim's browser, potentially leading to session theft, account takeover, or sensitive data leakage.

Recommendation

Immediately upgrade Liferay Portal to version 7.4.3 or later, and Liferay DXP to version 7.3 with Service Pack 3 installed.

Original NVD description (English source)

A cross-site scripting (XSS) vulnerability in Liferay Portal v7.3.3 through v7.4.2 and Liferay DXP v7.3 before service pack 3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the name of a tag.