Description

A cross-site scripting (XSS) vulnerability in Liferay Portal v7.3.3 through v7.4.2 and Liferay DXP v7.3 before service pack 3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the name of a tag.

Remediation

References

CVE-2022-28982

Related Vulnerabilities

WordPress Plugin Users Ultra Membership Arbitrary File Upload (1.5.58)

WordPress Plugin Simple Giveaways-Grow your business, email lists and traffic with contests Security Bypass (2.17.3)

WordPress Plugin Word of the day Arbitrary File Upload (1.0)

ZenCart Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2009-2254)

Zope Web Application Server Permissions, Privileges, and Access Controls Vulnerability (CVE-2012-5489)

Severity

Medium

Classification

CVE-2022-28982 CWE-707 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities