CVE-2022-28979

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2022-28979

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-28979.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2022-28979

Aliases

GHSA-7r3w-wggm-pjwf

Published

2022-09-21T23:22:44Z

Modified

2026-07-15T01:48:58.212052877Z

Severity

6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

[none]

Details

Liferay Portal v7.1.0 through v7.4.2 and Liferay DXP 7.1 before fix pack 26, 7.2 before fix pack 15, and 7.3 before service pack 3 was discovered to contain a cross-site scripting (XSS) vulnerability in the Portal Search module's Custom Facet widget. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Custom Parameter Name text field.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/28xxx/CVE-2022-28979.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "v7.1.0"
                },
                {
                    "fixed": "v7.4.2"
                },
                {
                    "introduced": "7.1"
                },
                {
                    "introduced": "7.2"
                },
                {
                    "introduced": "7.3"
                }
            ],
            "source": "DESCRIPTION"
        }
    ],
    "cna_assigner": "mitre"
}

References

Affected packages

Git / github.com/liferay/liferay-portal

Affected ranges

Type

GIT

Repo

https://github.com/liferay/liferay-portal

Events

Introduced

Fixed

75354f3482d7c5edb70f4cd72ed8664ce8079842

Database specific

{
    "extracted_events": [
        {
            "introduced": "v7.1.0"
        },
        {
            "fixed": "v7.4.2"
        }
    ],
    "source": "DESCRIPTION"
}

Affected versions

6.*

6.1.0-b1

6.1.0-b2

6.1.0-b3

6.1.0-b4

6.1.0-rc1

6.2.0-b1

6.2.0-b2

6.2.0-m2

6.2.0-m3

6.2.0-m4

6.2.0-m5

6.2.0-m6

7.*

7.0.0-m1

7.0.0-m2

7.0.0-m3

7.0.0-m4

7.0.0-m5

7.1.0-a1

7.1.0-a2

7.1.0-b1

7.1.0-b2

7.1.0-m1

7.1.0-m2

7.2.0-a1

7.2.0-b1

7.2.0-b2

7.2.0-b3

7.2.0-m2

7.3.0-ga1

7.3.1-ga2

7.3.2-ga3

7.3.3-ga4

7.3.4-ga5

7.3.5-ga6

7.4.0-ga1

7.4.1-ga2

sync-3.*

sync-3.0.0-b1

sync-3.0.1-b2

sync-3.0.10-ga2

sync-3.0.2-b3

sync-3.0.3-b4

sync-3.0.4-b5

sync-3.0.5-b6

sync-3.0.6-b7

sync-3.0.7-b8

sync-3.0.8-b9

sync-3.0.9-ga1

sync-3.1.0-ga1

Other

test-fix-pack-base-7310

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-28979.json"