Skip to content
OpenAdvisories
Medium · 5.4 CVE-2022-26593 BIT-liferay-2022-26593EUVD-2022-31148GHSA-q2rp-xfj8-r95h

Liferay Portal and Liferay DXP allows arbitrary injection via the name of an asset category

Published Apr 19, 2022 · Updated Jul 9, 2026 · Assigned by mitre

Package: com.liferay:com.liferay.asset.taglib Package: com.liferay.portal:release.dxp.bom Ecosystem: Maven

Description

Cross-site scripting (XSS) vulnerability in the Asset module's asset categories selector in Liferay Portal 7.3.3 through 7.4.0, and Liferay DXP 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the name of a asset category.

Affected packages

EcosystemPackageAffectedFixedRecord
Maven com.liferay:com.liferay.asset.taglib < 6.1.0 6.1.0 GHSA-q2rp-xfj8-r95h
Maven com.liferay.portal:release.dxp.bom >= 7.3.0, < 7.3.10.fp3 7.3.10.fp3 GHSA-q2rp-xfj8-r95h

References