CVE-2022-28980 Liferay Portal and Liferay DXP Vulnerable to XSS via the filter_ Prefix

What is CVE-2022-28980?

CVE-2022-28980 is a medium-severity cross-site scripting vulnerability in Liferay Liferay Portal, published on 22 Sep 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal v7.4.3.4 and Liferay DXP v7.4 GA allows attackers to execute arbitrary web scripts or HTML via parameters with the filter_ prefix.

Weakness: CWE-79

Which versions are affected by CVE-2022-28980?

4 open source packages ship an affected version, including com.liferay.portal:release.dxp.bom and com.liferay:com.liferay.fragment.renderer.collection.filter.impl. It affects 2 products.

Products include Liferay Dxp, Liferay Liferay Portal.

How do I fix CVE-2022-28980?

Upgrade com.liferay.portal:release.dxp.bom to 7.4.3.5-ga5 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2022-28980 being exploited?

There is no known exploitation of CVE-2022-28980 in the wild and no public exploit code.

Other vulnerabilities in Liferay Liferay Portal

• CVE-2022-42120 Liferay Portal and Liferay DXP Vulnerable to SQL Injection via the Fragment Module Critical 9.8
• CVE-2022-42122 Liferay Portal and Liferay DXP Vulnerable to SQL Injection via Friendly URL Module Critical 9.8
• CVE-2023-35030 Liferay Portal and Liferay DXP Vulnerable to CSRF via the Layout Module High 8.8
• CVE-2021-29053 Liferay Portal and Liferay DXP Vulnerable to Multiple SQL Injections High 8.8
• CVE-2021-33321 Liferay Portal and Liferay DXP insecure default configuration High 7.5

All Liferay Liferay Portal vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-8mp9-w7gr-pvj3.