TI-2022-09892 Aliases CVE-2022-26594 GHSA-658f-xhv4-p978

Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.3.5 through…

LOW 28CWE-79Published 2022-04-15 · Updated 2026-07-09

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.3.5 through 7.4.0, and Liferay DXP 7.3 before service pack 3 allow remote attackers to inject arbitrary web script or HTML via a form field's help text to (1) Forms module's form builder, or (2) App Builder module's object form view's form builder.

Why it matters now

EPSS 0.00728 54th percentileScored 2026-11-07

Fix Fixed com.liferay:com.liferay.dynamic.data.mapping.form.field.type (Maven): 6.0.11com.liferay.portal:release.dxp.bom (Maven): 7.3.10.fp3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA
—	com.liferay:com.liferay.dynamic.data.mapping.form.field.type (Maven)	before 6.0.11	6.0.11	Patch available	GHSA-658f-xhv4-p978
—	com.liferay.portal:release.dxp.bom (Maven)	7.3.0 to before 7.3.10.fp3	7.3.10.fp3	Patch available	GHSA-658f-xhv4-p978

— Vendor— Affected all versions Fixed in — No fix listed CNA
com.liferay:com.liferay.dynamic.data.mapping.form.field.type (Maven) Vendor— Affected before 6.0.11 Fixed in 6.0.11 Patch available GHSA-658f-xhv4-p978
com.liferay.portal:release.dxp.bom (Maven) Vendor— Affected 7.3.0 to before 7.3.10.fp3 Fixed in 7.3.10.fp3 Patch available GHSA-658f-xhv4-p978

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:liferay:liferay_portal::::::::	7.3.5 to before 7.3.7	Vulnerable	Liferay
cpe:2.3:a:liferay:liferay_portal:7.4.0:::::::*	7.4.0	Vulnerable	Liferay

cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:* Versions 7.3.5 to before 7.3.7 Vulnerable ·Liferay
cpe:2.3:a:liferay:liferay_portal:7.4.0:*:*:*:*:*:*:* Versions 7.4.0 Vulnerable ·Liferay

Remediation

Fix · GHSA-658f-xhv4-p978 com.liferay:com.liferay.dynamic.data.mapping.form.field.type (Maven) Fixed in 6.0.11 Advisory →
Fix · GHSA-658f-xhv4-p978 com.liferay.portal:release.dxp.bom (Maven) Fixed in 7.3.10.fp3 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2022-26594
2026-10-03 Alias added: GHSA-658f-xhv4-p978

References

Patch 1

https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-26594-xss-vulnerability-with-form-field-help-text

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2022-26594

Other 4

TI-2020-06440 Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote… KEVCVSS 3.1CRITICAL 9.8
TI-2019-12596 Liferay Portal CE 6.2.5 allows remote command execution because of deserialization of a JSON payload. CVSS 3.1CRITICAL 9.8
TI-2021-13252 Liferay Portal 6.2.5 allows Command=FileUpload&Type=File&CurrentFolder=/ requests when… CVSS 3.1CRITICAL 9.8
TI-2022-18349 A Cross-site scripting (XSS) vulnerability in the Blog module - add new topic… CVSS 3.1MEDIUM 5.4
TI-2022-18348 A Cross-site scripting (XSS) vulnerability in the Document and Media module - file upload… CVSS 3.1MEDIUM 5.4
TI-2022-20404 A SQL injection vulnerability in the Friendly Url module in Liferay Portal 7.3.7, and… CVSS 3.1CRITICAL 9.8

See all 318 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences