{"id":"BIT-liferay-2022-26593","details":"Cross-site scripting (XSS) vulnerability in the Asset module's asset categories selector in Liferay Portal 7.3.3 through 7.4.0, and Liferay DXP 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the name of a asset category.","aliases":["CVE-2022-26593","GHSA-q2rp-xfj8-r95h"],"modified":"2025-07-14T20:44:26.001308Z","published":"2024-01-31T15:21:17.676Z","database_specific":{"cpes":["cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:*","cpe:2.3:a:liferay:digital_experience_platform:7.3:-:*:*:*:*:*:*","cpe:2.3:a:liferay:digital_experience_platform:7.3:fix_pack_2:*:*:*:*:*:*"],"severity":"Medium"},"references":[{"type":"WEB","url":"http://liferay.com"},{"type":"WEB","url":"https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-26593-stored-xss-with-category-name-in-asset-categories-selector"}],"affected":[{"package":{"name":"liferay","ecosystem":"Bitnami","purl":"pkg:bitnami/liferay"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"7.3.0"}]},{"type":"SEMVER","events":[{"introduced":"7.3.0"},{"last_affected":"7.3.0"}]},{"type":"SEMVER","events":[{"introduced":"7.3-fix.0"},{"last_affected":"7.3-fix.0"}]}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/liferay/BIT-liferay-2022-26593.json"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"}]}],"schema_version":"1.7.3"}