Fluid Attacks Database

Description

Liferay Portal and Liferay DXP allows arbitrary injection via the name of an asset category Cross-site scripting (XSS) vulnerability in the Asset module's asset categories selector before 6.1.0 in Liferay Portal 7.3.3 through 7.4.0, and Liferay DXP 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the name of an asset category.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
maven	com.liferay.portal:release.dxp.bom	>=7.3.0 <7.3.10.fp3	7.3.10.fp3
maven	com.liferay:com.liferay.asset.taglib	>=0 <6.1.0	6.1.0

Aliases

1. CVE-2022-265932. NVD-2022-265933. OSV-2022-265934. GCVE-2022-26593

References

1. https://github.com/liferay/liferay-portal/commit/811d894cb079aba3644771a70cd9a2dfd36b945d2. https://liferay.atlassian.net/issues/LPE-172843. https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2022-26593-stored-xss-with-category-name-in-asset-categories-selector?p_r_p_assetEntryId=121612145&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121612145%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse