CVE-2022-38902

MediumCVSS 5.4

Published: 13/10/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.54%

41th percentile - higher than 41% of all known CVEs

Summary

A Cross-site scripting (XSS) vulnerability was found in the Blog module of Liferay Digital Experience Platform 7.3.10 SP3. It allows remote attackers to inject arbitrary JS or HTML into the name field of a new topic.

Risk Assessment

An attacker can exploit this vulnerability to steal user sessions, redirect to malicious sites, or exfiltrate sensitive data, compromising the confidentiality and integrity of the system.

Recommendation

Immediately update Liferay Digital Experience Platform to a patched version or apply available security fixes. Additionally, implement input validation and output encoding for form fields.

Original NVD description (English source)

A Cross-site scripting (XSS) vulnerability in the Blog module - add new topic functionality in Liferay Digital Experience Platform 7.3.10 SP3 allows remote attackers to inject arbitrary JS script or HTML into the name field of newly created topic.