Liferay Portal/DXP Authenticated Persistent XSS Vulnerabilities (CVE-2022-38901/38902)

Critical Vulnerability Information Vulnerability Type Authenticated Persistent XSS (Cross-Site Scripting) Vulnerability IDs CVE-2022-38901 CVE-2022-38902 Affected Products and Versions CVE-2022-38901: - Liferay Portal 7.3.5 - 7.4.3.28 - Liferay DXP 7.3 before update 6 - Liferay DXP 7.4 before update 29 CVE-2022-38902: - Liferay Portal 7.3.0 - 7.4.0 - Liferay DXP 7.3 before update 9 Vulnerability Description 1. XSS Vulnerability in File Upload Function - In the file upload feature of the “Document and Media” module, attackers can exploit this by uploading an SVG file containing malicious JavaScript, injecting the malicious code into the “Description” field. When an authenticated user views the file or its description, the malicious JavaScript will be executed. - Affected parameter: 2. XSS Vulnerability in Category Name - Attackers can inject arbitrary JavaScript scripts into the “Name” text field of any asset that supports categorization. For example, this vulnerability can be exploited in the “Content & Data > Blogs module > categorization section”. - Affected parameter: Mitigation Vulnerability report submitted and disclosed responsibly, verified and confirmed by Liferay official team. Fixed versions: Liferay Portal 7.4 GA4 (7.4.3.4) and later versions Risk and Impact Successful exploitation may allow attackers to execute arbitrary actions on behalf of victim users, potentially leading to privilege escalation.

Goal Reached Thanks to every supporter — we hit 100%!

Liferay Portal/DXP Authenticated Persistent XSS Vulnerabilities (CVE-2022-38901/38902)