GHSA-q2rp-xfj8-r95h

Liferay Portal and Liferay DXP allows arbitrary injection via the name of an asset category

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-26593

Packages

Ecosystem	Package	Affected	Fixed in
Maven	com.liferay:com.liferay.asset.taglib	< 6.1.0	6.1.0
Maven	com.liferay.portal:release.dxp.bom	>= 7.3.0, < 7.3.10.fp3	7.3.10.fp3

Details

As written in the advisory (Markdown source, shown as plain text).

Cross-site scripting (XSS) vulnerability in the Asset module's asset categories selector before 6.1.0 in Liferay Portal 7.3.3 through 7.4.0, and Liferay DXP 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the name of an asset category.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-26593 advisory
https://github.com/liferay/liferay-portal/commit/811d894cb079aba3644771a70cd9a2dfd36b945d web
https://github.com/liferay/liferay-portal package
https://liferay.atlassian.net/issues/LPE-17284 web
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2022-26593-stored-xss-with-category-name-in-ass… web