CVE-2022-28979

EPSS 0.47%
Published 22.09.2022 00:15:09
Last modified 27.05.2025 20:15:22
Source cve@mitre.org
Teams watchlist Login
Open Login

Liferay Portal v7.1.0 through v7.4.2 and Liferay DXP 7.1 before fix pack 26, 7.2 before fix pack 15, and 7.3 before service pack 3 was discovered to contain a cross-site scripting (XSS) vulnerability in the Portal Search module's Custom Facet widget. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Custom Parameter Name text field.

Affected products Warnungen 0 Metrics 3 CWE 1 References 6

Data is provided by the National Vulnerability Database (NVD)

Liferay ≫ Digital Experience Platform Version7.1 Update-

Liferay ≫ Digital Experience Platform Version7.1 Updatefix_pack_1

Liferay ≫ Digital Experience Platform Version7.1 Updatefix_pack_10

Liferay ≫ Digital Experience Platform Version7.1 Updatefix_pack_11

Liferay ≫ Digital Experience Platform Version7.1 Updatefix_pack_12

Liferay ≫ Digital Experience Platform Version7.1 Updatefix_pack_13

Liferay ≫ Digital Experience Platform Version7.1 Updatefix_pack_14

Liferay ≫ Digital Experience Platform Version7.1 Updatefix_pack_15

Liferay ≫ Digital Experience Platform Version7.1 Updatefix_pack_16

Liferay ≫ Digital Experience Platform Version7.1 Updatefix_pack_17

Liferay ≫ Digital Experience Platform Version7.1 Updatefix_pack_18

Liferay ≫ Digital Experience Platform Version7.1 Updatefix_pack_19

Liferay ≫ Digital Experience Platform Version7.1 Updatefix_pack_2

Liferay ≫ Digital Experience Platform Version7.1 Updatefix_pack_20

Liferay ≫ Digital Experience Platform Version7.1 Updatefix_pack_21

Liferay ≫ Digital Experience Platform Version7.1 Updatefix_pack_22

Liferay ≫ Digital Experience Platform Version7.1 Updatefix_pack_23

Liferay ≫ Digital Experience Platform Version7.1 Updatefix_pack_24

Liferay ≫ Digital Experience Platform Version7.1 Updatefix_pack_25

Liferay ≫ Digital Experience Platform Version7.1 Updatefix_pack_3

Liferay ≫ Digital Experience Platform Version7.1 Updatefix_pack_4

Liferay ≫ Digital Experience Platform Version7.1 Updatefix_pack_5

Liferay ≫ Digital Experience Platform Version7.1 Updatefix_pack_6

Liferay ≫ Digital Experience Platform Version7.1 Updatefix_pack_7

Liferay ≫ Digital Experience Platform Version7.1 Updatefix_pack_8

Liferay ≫ Digital Experience Platform Version7.1 Updatefix_pack_9

Liferay ≫ Digital Experience Platform Version7.2 Update-

Liferay ≫ Digital Experience Platform Version7.2 Updatefix_pack_1

Liferay ≫ Digital Experience Platform Version7.2 Updatefix_pack_10

Liferay ≫ Digital Experience Platform Version7.2 Updatefix_pack_11

Liferay ≫ Digital Experience Platform Version7.2 Updatefix_pack_12

Liferay ≫ Digital Experience Platform Version7.2 Updatefix_pack_13

Liferay ≫ Digital Experience Platform Version7.2 Updatefix_pack_14

Liferay ≫ Digital Experience Platform Version7.2 Updatefix_pack_2

Liferay ≫ Digital Experience Platform Version7.2 Updatefix_pack_3

Liferay ≫ Digital Experience Platform Version7.2 Updatefix_pack_4

Liferay ≫ Digital Experience Platform Version7.2 Updatefix_pack_5

Liferay ≫ Digital Experience Platform Version7.2 Updatefix_pack_6

Liferay ≫ Digital Experience Platform Version7.2 Updatefix_pack_7

Liferay ≫ Digital Experience Platform Version7.2 Updatefix_pack_8

Liferay ≫ Digital Experience Platform Version7.2 Updatefix_pack_9

Liferay ≫ Dxp Version7.3 Update-

Liferay ≫ Dxp Version7.3 Updatesp1

Liferay ≫ Dxp Version7.3 Updatesp2

Liferay ≫ Dxp Version7.3 Updatesp3

Liferay ≫ Liferay Portal Version >= 7.1.0 < 7.4.3.4

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.47%	0.636

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	6.1	2.8	2.7	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
134c704f-9b21-4f2e-91b3-4a467353bcc0	6.1	2.8	2.7	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

http://liferay.com

Product

https://issues.liferay.com/browse/LPE-17381

Patch

Vendor Advisory

Issue Tracking

https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-28979-xss-in-custom-facet-widget

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2022-28979

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2022-28979

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2022-28979

EUVD