Description

A Cross-site scripting (XSS) vulnerability in the Document and Media module - file upload functionality in Liferay Digital Experience Platform 7.3.10 SP3 allows remote attackers to inject arbitrary JS script or HTML into the description field of uploaded svg file.

Remediation

References

CVE-2022-38901

Related Vulnerabilities

Python CVE-2019-9636 Vulnerability (CVE-2019-9636)

Drupal Core 7.x Security Bypass (7.0 - 7.43)

WordPress Plugin Arabic Font Multiple Vulnerabilities (1.2)

WordPress Plugin WP Hotel Booking Cross-Site Request Forgery (1.10.5)

WordPress Plugin NextCellent Gallery-NextGEN Legacy Cross-Site Scripting (1.9.17)

Severity

Medium

Classification

CVE-2022-38901 CWE-707 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities