{"id":"GHSA-8mp9-w7gr-pvj3","summary":"Liferay Portal and Liferay DXP Vulnerable to XSS via the filter_ Prefix","details":"Multiple cross-site scripting (XSS) vulnerabilities in Liferay Fragment Renderer Collection Filter Implementation before v1.0.11 from Liferay Portal (v7.4.3.4) and Liferay DXP v7.4 GA allows attackers to execute arbitrary web scripts or HTML via parameters with the filter_ prefix.","aliases":["CVE-2022-28980"],"modified":"2025-07-16T15:57:16.109237Z","published":"2022-09-23T00:00:46Z","database_specific":{"nvd_published_at":"2022-09-22T01:15:00Z","cwe_ids":["CWE-79"],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2025-07-16T14:54:08Z"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-28980"},{"type":"WEB","url":"https://github.com/liferay/liferay-portal/commit/b4ea3e9acb6c3602b9c90538ba35f11906dc07ed"},{"type":"PACKAGE","url":"https://github.com/liferay/liferay-portal"},{"type":"WEB","url":"https://liferay.atlassian.net/browse/LPE-17420"},{"type":"WEB","url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2022-28980-reflected-xss-with-filter_-parameters-in-applied-fragment-filters?p_r_p_assetEntryId=121612438&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121612438%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse"},{"type":"WEB","url":"https://web.archive.org/web/20221114081624/https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-28980-reflected-xss-with-filter_*-parameters-in-applied-fragment-filters"},{"type":"WEB","url":"http://liferay.com"}],"affected":[{"package":{"name":"com.liferay:com.liferay.fragment.renderer.collection.filter.impl","ecosystem":"Maven","purl":"pkg:maven/com.liferay/com.liferay.fragment.renderer.collection.filter.impl"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.11"}]}],"versions":["1.0.0","1.0.1","1.0.10","1.0.2","1.0.3","1.0.4","1.0.5","1.0.6","1.0.7","1.0.8","1.0.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/09/GHSA-8mp9-w7gr-pvj3/GHSA-8mp9-w7gr-pvj3.json"}},{"package":{"name":"com.liferay.portal:release.dxp.bom","ecosystem":"Maven","purl":"pkg:maven/com.liferay.portal/release.dxp.bom"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.3.5-ga5"}]}],"versions":["7.0.10.14","7.0.10.14-1","7.0.10.16","7.0.10.17","7.0.10.7","7.0.10.8","7.0.10.9","7.0.10.fp100","7.0.10.fp101","7.0.10.fp102","7.0.10.fp60","7.0.10.fp61","7.0.10.fp62","7.0.10.fp63","7.0.10.fp64","7.0.10.fp65","7.0.10.fp66","7.0.10.fp67","7.0.10.fp68","7.0.10.fp69","7.0.10.fp70","7.0.10.fp71","7.0.10.fp72","7.0.10.fp73","7.0.10.fp74","7.0.10.fp75","7.0.10.fp76","7.0.10.fp77","7.0.10.fp78","7.0.10.fp79","7.0.10.fp80","7.0.10.fp81","7.0.10.fp82","7.0.10.fp83","7.0.10.fp84","7.0.10.fp85","7.0.10.fp85-1","7.0.10.fp86","7.0.10.fp86-1","7.0.10.fp87","7.0.10.fp87-1","7.0.10.fp88","7.0.10.fp89","7.0.10.fp90","7.0.10.fp91","7.0.10.fp92","7.0.10.fp94","7.0.10.fp94-1","7.0.10.fp95","7.0.10.fp95-1","7.0.10.fp95-2","7.0.10.fp97","7.0.10.fp98","7.1.10","7.1.10.1","7.1.10.3","7.1.10.4","7.1.10.5","7.1.10.6","7.1.10.7","7.1.10.8","7.1.10.fp1","7.1.10.fp10","7.1.10.fp11","7.1.10.fp12","7.1.10.fp13","7.1.10.fp14","7.1.10.fp15","7.1.10.fp16","7.1.10.fp17","7.1.10.fp18","7.1.10.fp19","7.1.10.fp2","7.1.10.fp20","7.1.10.fp22","7.1.10.fp24","7.1.10.fp25","7.1.10.fp26","7.1.10.fp27","7.1.10.fp28","7.1.10.fp3","7.1.10.fp4","7.1.10.fp5","7.1.10.fp6","7.1.10.fp7","7.1.10.fp8","7.1.10.fp9","7.2.1","7.2.10","7.2.10.1","7.2.10.2","7.2.10.3","7.2.10.3-1","7.2.10.4","7.2.10.4-1","7.2.10.5","7.2.10.5-1","7.2.10.6","7.2.10.7","7.2.10.8","7.2.10.fp1","7.2.10.fp1-1","7.2.10.fp10","7.2.10.fp11","7.2.10.fp12","7.2.10.fp13","7.2.10.fp14","7.2.10.fp15","7.2.10.fp16","7.2.10.fp17","7.2.10.fp18","7.2.10.fp19","7.2.10.fp2","7.2.10.fp20","7.2.10.fp3","7.2.10.fp4","7.2.10.fp5","7.2.10.fp6","7.2.10.fp7","7.2.10.fp8","7.2.10.fp9","7.3.10","7.3.10.0-2","7.3.10.1","7.3.10.3","7.3.10.ep3","7.3.10.ep4","7.3.10.ep5","7.3.10.fp1","7.3.10.fp2","7.3.10.u10","7.3.10.u11","7.3.10.u12","7.3.10.u13","7.3.10.u14","7.3.10.u15","7.3.10.u16","7.3.10.u17","7.3.10.u18","7.3.10.u19","7.3.10.u19-1","7.3.10.u20","7.3.10.u20-1","7.3.10.u21","7.3.10.u21-1","7.3.10.u22","7.3.10.u22-1","7.3.10.u23","7.3.10.u24","7.3.10.u25","7.3.10.u26","7.3.10.u27","7.3.10.u28","7.3.10.u29","7.3.10.u30","7.3.10.u31","7.3.10.u32","7.3.10.u33","7.3.10.u34","7.3.10.u35","7.3.10.u36","7.3.10.u4","7.3.10.u5","7.3.10.u6","7.3.10.u7","7.3.10.u8","7.3.10.u9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/09/GHSA-8mp9-w7gr-pvj3/GHSA-8mp9-w7gr-pvj3.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}