Description

A Cross-site scripting (XSS) vulnerability in the Document and Media module - file upload functionality in Liferay Digital Experience Platform 7.3.10 SP3 allows remote attackers to inject arbitrary JS script or HTML into the description field of uploaded svg file.

Remediation

References

CVE-2022-38901

Related Vulnerabilities

Python Uncontrolled Resource Consumption Vulnerability (CVE-2012-0876)

WordPress Plugin Customer Service Software & Support Ticket System Cross-Site Scripting (5.10.3)

MediaWiki Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2008-5250)

WordPress Plugin Side Menu Lite-add sticky fixed buttons SQL Injection (2.2)

Liferay Portal URL Redirection to Untrusted Site ('Open Redirect') Vulnerability (CVE-2024-25609)

Severity

Medium

Classification

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities CWE-707 CVE-2022-38901