CVE-2022-28980: Liferay Fragment Renderer Collection Filter Implementation Vulnerable to XSS via filter_ Prefix
Summary
CVE-2022-28980: Liferay Portal and Liferay DXP Vulnerable to XSS via the filter_ Prefix. Affects com.liferay:com.liferay.fragment.renderer.collection.filter.impl versions < 1.0.11. Fixed in 1.0.11. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Liferay Fragment Renderer Collection Filter Implementation is a component of the Liferay Portal and Liferay DXP that allows users to create and manage web content fragments. This package is designed to enhance the flexibility and usability of web applications by enabling dynamic content rendering. However, it has been identified to have vulnerabilities that can be exploited through cross-site scripting (XSS), which can lead to unauthorized script execution in the user's browser.
Vulnerability Detail
Multiple cross-site scripting (XSS) vulnerabilities exist in Liferay Fragment Renderer Collection Filter Implementation before version 1.0.11. These vulnerabilities arise from improper handling of user input, specifically parameters prefixed with 'filter_'. Attackers can exploit these vulnerabilities to execute arbitrary web scripts or HTML in the context of the affected application, potentially leading to data theft, session hijacking, or other malicious activities.
How To Fix
Latest published version: 1.0.38 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.0.11
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can sanitize user inputs by implementing input validation and escaping mechanisms to prevent the execution of malicious scripts. This can be done by using libraries that provide XSS protection or by manually encoding user input before rendering it on the web page.
Conclusion
In summary, CVE-2022-28980 presents a moderate risk due to XSS vulnerabilities in the Liferay Fragment Renderer Collection Filter Implementation. It is crucial for users to update to the latest patched versions to mitigate potential security risks and ensure the integrity of their applications.
See every vulnerability recorded for com.liferay:com.liferay.fragment.renderer.collection.filter.impl →
FAQ
CVE-2022-28980 is a vulnerability in the Liferay Fragment Renderer Collection Filter Implementation that allows for cross-site scripting (XSS) attacks.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time based on your pom.xml file.
The vulnerability can lead to unauthorized script execution, data theft, and session hijacking, compromising the security of the application and its users.
Yes, a patch is available. Update to version 1.0.11 of the com.liferay.fragment.renderer.collection.filter.impl package or version 7.4.3.5-ga5 of the Liferay Portal.
Vulert is a tool that monitors open-source vulnerabilities using just the pom.xml file, providing real-time alerts without requiring code access or installation.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
