CVE-2022-28978

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-28978
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-28978.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-28978
Aliases
Published
2022-09-21T23:38:59Z
Modified
2026-07-15T01:48:55.988896979Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

Stored cross-site scripting (XSS) vulnerability in the Site module's user membership administration page in Liferay Portal 7.0.1 through 7.4.1, and Liferay DXP 7.0 before fix pack 102, 7.1 before fix pack 26, 7.2 before fix pack 15, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the a user's name.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/28xxx/CVE-2022-28978.json",
    "cna_assigner": "mitre",
    "unresolved_ranges": [
        {
            "source": "DESCRIPTION",
            "extracted_events": [
                {
                    "introduced": "7.0.1"
                },
                {
                    "fixed": "7.4.1"
                },
                {
                    "introduced": "7.0"
                },
                {
                    "introduced": "7.1"
                },
                {
                    "introduced": "7.2"
                },
                {
                    "introduced": "7.3"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/liferay/liferay-portal

Affected ranges

Type
GIT
Repo
https://github.com/liferay/liferay-portal
Events
Introduced
16d03be248641f92824e33f48a0ff952dfe59703
Fixed
75354f3482d7c5edb70f4cd72ed8664ce8079842
Database specific 
{
    "cpe": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*",
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "7.0.1"
        },
        {
            "fixed": "7.4.2"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-28978.json"