CVE-2022-38901
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
A Cross-site scripting (XSS) vulnerability in the Document and Media module - file upload functionality in Liferay Digital Experience Platform 7.3.10 SP3 allows remote attackers to inject arbitrary JS script or HTML into the description field of uploaded SVG file.
Risk Assessment
An attacker can exploit this vulnerability to steal user sessions, redirect to malicious sites, or perform other actions in the victim's browser context, compromising data confidentiality and integrity.
Recommendation
Immediately update Liferay Digital Experience Platform to a patched version or apply available security fixes. Additionally, implement input filtering and sanitization for file description fields.
Original NVD description (English source)
A Cross-site scripting (XSS) vulnerability in the Document and Media module - file upload functionality in Liferay Digital Experience Platform 7.3.10 SP3 allows remote attackers to inject arbitrary JS script or HTML into the description field of uploaded svg file.