Skip to content
OpenAdvisories
Medium · 6.1 CVE-2022-28980 EUVD-2022-33411GHSA-8mp9-w7gr-pvj3

Liferay Portal and Liferay DXP Vulnerable to XSS via the filter_ Prefix

Published Sep 22, 2022 · Updated Jul 9, 2026 · Assigned by mitre

Package: com.liferay:com.liferay.fragment.renderer.collection.filter.impl Package: com.liferay.portal:release.dxp.bom Ecosystem: Maven

Description

Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal v7.4.3.4 and Liferay DXP v7.4 GA allows attackers to execute arbitrary web scripts or HTML via parameters with the filter_ prefix.

Affected packages

EcosystemPackageAffectedFixedRecord
Maven com.liferay:com.liferay.fragment.renderer.collection.filter.impl < 1.0.11 1.0.11 GHSA-8mp9-w7gr-pvj3
Maven com.liferay.portal:release.dxp.bom < 7.4.3.5-ga5 7.4.3.5-ga5 GHSA-8mp9-w7gr-pvj3

References