{"id":"BIT-liferay-2022-26597","details":"Cross-site scripting (XSS) vulnerability in the Layout module's Open Graph integration in Liferay Portal 7.3.0 through 7.4.0, and Liferay DXP 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the site name.","aliases":["CVE-2022-26597","GHSA-3vww-jrmm-9vff"],"modified":"2025-07-14T22:26:56.363196Z","published":"2024-01-31T15:20:52.371Z","database_specific":{"severity":"Medium","cpes":["cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:*","cpe:2.3:a:liferay:digital_experience_platform:7.3:-:*:*:*:*:*:*","cpe:2.3:a:liferay:digital_experience_platform:7.3:fix_pack_1:*:*:*:*:*:*","cpe:2.3:a:liferay:digital_experience_platform:7.3:fix_pack_2:*:*:*:*:*:*"]},"references":[{"type":"WEB","url":"http://liferay.com"}],"affected":[{"package":{"name":"liferay","ecosystem":"Bitnami","purl":"pkg:bitnami/liferay"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"7.3.0"}]},{"type":"SEMVER","events":[{"introduced":"7.3.0"},{"last_affected":"7.3.0"}]},{"type":"SEMVER","events":[{"introduced":"7.3-fix.0"},{"last_affected":"7.3-fix.0"},{"introduced":"7.3-fix.0"},{"last_affected":"7.3-fix.0"}]}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/liferay/BIT-liferay-2022-26597.json"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}],"schema_version":"1.7.3"}