Unrated severityNVD Advisory· Published Oct 13, 2022· Updated May 15, 2025

CVE-2022-38902

Description

A Cross-site scripting (XSS) vulnerability in the Blog module - add new topic functionality in Liferay Digital Experience Platform 7.3.10 SP3 allows remote attackers to inject arbitrary JS script or HTML into the name field of newly created topic.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Liferay/Digital Experience Platformcpe-rescue2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: = 7.3.10 SP3

Patches

Vulnerability mechanics

References

liferay.commitre
drive.proton.me/urls/D27RQ14NGWmitre
www.offensity.com/en/blog/authenticated-persistent-xss-in-liferay-dxp-cms-cve-2022-38901-and-cve-2022-38902/mitre

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000