CVE-2022-38902

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2022-38902

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-38902.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2022-38902

Published

2022-10-13T00:00:00Z

Modified

2026-07-15T01:48:56.344226987Z

Severity

5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

[none]

Details

A Cross-site scripting (XSS) vulnerability in the Blog module - add new topic functionality in Liferay Digital Experience Platform 7.3.10 SP3 allows remote attackers to inject arbitrary JS script or HTML into the name field of newly created topic.

Database specific

{
    "cna_assigner": "mitre",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/38xxx/CVE-2022-38902.json"
}

References

Affected packages

Git / github.com/liferay/liferay-portal

Affected ranges

Type

GIT

Repo

https://github.com/liferay/liferay-portal

Events

Introduced

b072f5df5544a28677824835b490ce8a867bf133

Last affected

ec84d86679146b84af526f96471a730c340dda78

Database specific

{
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "7.3.0"
        },
        {
            "last_affected": "7.4.0"
        }
    ],
    "cpe": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*"
}

Affected versions

7.*

7.3.0-ga1

7.3.1-ga2

7.3.2-ga3

7.3.3-ga4

7.3.4-ga5

7.3.5-ga6

7.4.0-ga1

Other

test-fix-pack-base-7310

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-38902.json"