CVE-2022-26593

Cross-site scripting (XSS) vulnerability in the Asset module's asset categories selector in Liferay Portal 7.3.3 through 7.4.0, and Liferay DXP 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the name of a asset category.

Score

CVSS 3.1 5.4 Medium

Status

Modified - cve@mitre.org

Published

2022-04-19

Last modified

2026-07-09

Weaknesses

CWE-79

Affected products

• Digital Experience Platform (Liferay)
• Liferay Portal (Liferay)

References

• https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-26593-s…