Unrated severityNVD Advisory· Published Oct 19, 2022· Updated May 9, 2025

CVE-2022-38901

Description

A Cross-site scripting (XSS) vulnerability in the Document and Media module - file upload functionality in Liferay Digital Experience Platform 7.3.10 SP3 allows remote attackers to inject arbitrary JS script or HTML into the description field of uploaded svg file.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Liferay/Digital Experience Platformcpe-rescue2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: =7.3.10 SP3

Patches

Vulnerability mechanics

References

liferay.commitre
drive.proton.me/urls/D27RQ14NGWmitre
www.offensity.com/en/blog/authenticated-persistent-xss-in-liferay-dxp-cms-cve-2022-38901-and-cve-2022-38902/mitre

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000