VULNERABILITY INTELLIGENCE
CVE-2022-26596
CVSS score6.1 MEDIUM
EPSS probability0.72%
CISA KEVNot currently listed
Published2022-04-25
Last modified2026-07-09
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Description
Cross-site scripting (XSS) vulnerability in Journal module's web content display configuration page in Liferay Portal 7.1.0 through 7.3.3, and Liferay DXP 7.0 before fix pack 94, 7.1 before fix pack 19, and 7.2 before fix pack 8, allows remote attackers to inject arbitrary web script or HTML via web content template names.
Weakness classification
- nvd@nist.gov: CWE-79