Liferay Portal Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability - CVE-2022-38901 - Vulnerability Database

Liferay Portal Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability - CVE-2022-38901

Medium

Reference: CVE-2022-38901

NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2022-38901

Title: Liferay Portal Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability

Overview:

A Cross-site scripting (XSS) vulnerability in the Document and Media module - file upload functionality in Liferay Digital Experience Platform 7.3.10 SP3 allows remote attackers to inject arbitrary JS script or HTML into the description field of uploaded svg file.