CVE-2022-28982: Liferay Asset Taglib Vulnerable to XSS via Tag Name
Summary
CVE-2022-28982: Liferay Portal and Liferay DXP Vulnerable to XSS via Tag Name. Affects com.liferay:com.liferay.asset.taglib versions < 6.1.9. Fixed in 6.1.9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Liferay Asset Taglib is a component of the Liferay Portal, a popular open-source platform for building web applications and managing content. This library provides functionalities for managing asset tags, which are used to categorize and organize content within the portal. The vulnerability in question affects versions prior to 6.1.9, allowing for potential security risks due to improper handling of user input.
Vulnerability Detail
A cross-site scripting (XSS) vulnerability exists in Liferay Asset Taglib versions before 6.1.9. This flaw allows attackers to inject malicious scripts into the name of a tag, which can then be executed in the context of a user's browser. The vulnerability arises from inadequate input validation, enabling the execution of arbitrary web scripts or HTML. If exploited, this could lead to unauthorized actions being performed on behalf of users, data theft, or other malicious activities.
How To Fix
Minimum fixed version
6.1.9
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider implementing input validation on tag names to sanitize user input and prevent script injection. This can be done by escaping special characters or using a library that provides XSS protection.
Conclusion
The CVE-2022-28982 vulnerability in Liferay Asset Taglib poses a significant risk due to its potential for XSS attacks. It is crucial for users of affected versions to update to 6.1.9 or later to mitigate this risk. Additionally, implementing input validation can serve as a temporary workaround until the update is applied.
See every vulnerability recorded for com.liferay:com.liferay.asset.taglib →
FAQ
CVE-2022-28982 is a vulnerability in Liferay Asset Taglib that allows for cross-site scripting (XSS) attacks via tag names.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in your software by analyzing the pom.xml file.
Exploitation of this vulnerability can lead to unauthorized actions, data theft, and other malicious activities performed in the context of a user's session.
Yes, the vulnerability is fixed in version 6.1.9 of the Liferay Asset Taglib. Updating to this version will resolve the issue.
The CVSS score for this vulnerability is 6.1, indicating a moderate level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for com.liferay:com.liferay.asset.taglib.
