{"id":"CVE-2022-26594","details":"Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.3.5 through 7.4.0, and Liferay DXP 7.3 before service pack 3 allow remote attackers to inject arbitrary web script or HTML via a form field's help text to (1) Forms module's form builder, or (2) App Builder module's object form view's form builder.","aliases":["GHSA-658f-xhv4-p978"],"modified":"2026-09-05T03:30:43.289399731Z","published":"2022-04-15T15:50:26Z","database_specific":{"unresolved_ranges":[{"extracted_events":[{"introduced":"7.3.5"},{"fixed":"7.4.0"},{"introduced":"7.3"}],"source":"DESCRIPTION"}],"cna_assigner":"mitre","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/26xxx/CVE-2022-26594.json"},"references":[{"type":"WEB","url":"https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-26594-xss-vulnerability-with-form-field-help-text"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/26xxx/CVE-2022-26594.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-26594"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/liferay/liferay-portal","events":[{"introduced":"f193301b2848899b008d51513af62a3b3a9b7888"},{"fixed":"29b73b9b896c7d44fb5d1800a402698c303d1cf6"},{"introduced":"ec84d86679146b84af526f96471a730c340dda78"},{"last_affected":"ec84d86679146b84af526f96471a730c340dda78"}],"database_specific":{"cpe":["cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.4.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"7.3.5"},{"fixed":"7.3.7"},{"introduced":"7.4.0"},{"last_affected":"7.4.0"}],"source":["CPE_RANGE","CPE_STRING"]}}],"versions":["7.4.0","7.4.0-ga1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-26594.json"}}],"schema_version":"1.9.0"}