{"id":"CVE-2022-26593","details":"Cross-site scripting (XSS) vulnerability in the Asset module's asset categories selector in Liferay Portal 7.3.3 through 7.4.0, and Liferay DXP 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the name of a asset category.","aliases":["BIT-liferay-2022-26593","GHSA-q2rp-xfj8-r95h"],"modified":"2026-09-05T03:31:08.524918419Z","published":"2022-04-19T12:46:15Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/26xxx/CVE-2022-26593.json","unresolved_ranges":[{"extracted_events":[{"introduced":"7.3.3"},{"fixed":"7.4.0"},{"introduced":"7.3"}],"source":"DESCRIPTION"}],"cna_assigner":"mitre"},"references":[{"type":"WEB","url":"https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-26593-stored-xss-with-category-name-in-asset-categories-selector"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/26xxx/CVE-2022-26593.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-26593"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/liferay/liferay-portal","events":[{"introduced":"77b773677e0fa17b1a869414ad66220245ba96a8"},{"fixed":"29b73b9b896c7d44fb5d1800a402698c303d1cf6"},{"introduced":"ec84d86679146b84af526f96471a730c340dda78"},{"last_affected":"ec84d86679146b84af526f96471a730c340dda78"}],"database_specific":{"cpe":["cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.4.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"7.3.3"},{"fixed":"7.3.7"},{"introduced":"7.4.0"},{"last_affected":"7.4.0"}],"source":["CPE_RANGE","CPE_STRING"]}}],"versions":["7.4.0","7.3.6-ga7","7.4.0-ga1","7.3.4-ga5","test-fix-pack-base-7310","7.3.3-ga4"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-26593.json"}}],"schema_version":"1.9.0"}