Read the docs
TI-2022-11562 Aliases CVE-2022-28978GHSA-7m65-hmvg-rxpc

Stored cross-site scripting (XSS) vulnerability in the Site module's user membership…

Priority LOW 26CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Stored cross-site scripting (XSS) vulnerability in the Site module's user membership administration page in Liferay Portal 7.0.1 through 7.4.1, and Liferay DXP 7.0 before fix pack 102, 7.1 before fix pack 26, 7.2 before fix pack 15, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the a user's name.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00683 52nd percentileScored 2026-11-07
Fix Fixed com.liferay:com.liferay.site.memberships.web (Maven): 5.0.10com.liferay.portal:release.dxp.bom (Maven): 7.0.10.fp102, 7.1.10.fp26, 7.2.10.fp15

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—com.liferay:com.liferay.site.memberships.web (Maven)before 5.0.105.0.10Patch availableGHSA-7m65-hmvg-rxpc
—com.liferay.portal:release.dxp.bom (Maven)7.0.0 to before 7.0.10.fp1027.0.10.fp102Patch availableGHSA-7m65-hmvg-rxpc
—com.liferay.portal:release.dxp.bom (Maven)7.1.0 to before 7.1.10.fp267.1.10.fp26Patch availableGHSA-7m65-hmvg-rxpc
—com.liferay.portal:release.dxp.bom (Maven)7.2.0 to before 7.2.10.fp157.2.10.fp15Patch availableGHSA-7m65-hmvg-rxpc
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • com.liferay:com.liferay.site.memberships.web (Maven) Vendor— Affected before 5.0.10 Fixed in 5.0.10 Patch available GHSA-7m65-hmvg-rxpc
  • com.liferay.portal:release.dxp.bom (Maven) Vendor— Affected 7.0.0 to before 7.0.10.fp102 Fixed in 7.0.10.fp102 Patch available GHSA-7m65-hmvg-rxpc
  • com.liferay.portal:release.dxp.bom (Maven) Vendor— Affected 7.1.0 to before 7.1.10.fp26 Fixed in 7.1.10.fp26 Patch available GHSA-7m65-hmvg-rxpc
  • com.liferay.portal:release.dxp.bom (Maven) Vendor— Affected 7.2.0 to before 7.2.10.fp15 Fixed in 7.2.10.fp15 Patch available GHSA-7m65-hmvg-rxpc

CPE configurations NVD · 116

CPEVersionsRoleVendor
cpe:2.3:a:liferay:digital_experience_platform:7.0:-:*:*:*:*:*:*7.0VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_100:*:*:*:*:*:*7.0 fix_pack_100VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_101:*:*:*:*:*:*7.0 fix_pack_101VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_13:*:*:*:*:*:*7.0 fix_pack_13VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_14:*:*:*:*:*:*7.0 fix_pack_14VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_24:*:*:*:*:*:*7.0 fix_pack_24VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_25:*:*:*:*:*:*7.0 fix_pack_25VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_26:*:*:*:*:*:*7.0 fix_pack_26VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_27:*:*:*:*:*:*7.0 fix_pack_27VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_28:*:*:*:*:*:*7.0 fix_pack_28VulnerableLiferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:-:*:*:*:*:*:* Versions 7.0 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_100:*:*:*:*:*:* Versions 7.0 fix_pack_100 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_101:*:*:*:*:*:* Versions 7.0 fix_pack_101 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_13:*:*:*:*:*:* Versions 7.0 fix_pack_13 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_14:*:*:*:*:*:* Versions 7.0 fix_pack_14 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_24:*:*:*:*:*:* Versions 7.0 fix_pack_24 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_25:*:*:*:*:*:* Versions 7.0 fix_pack_25 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_26:*:*:*:*:*:* Versions 7.0 fix_pack_26 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_27:*:*:*:*:*:* Versions 7.0 fix_pack_27 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_28:*:*:*:*:*:* Versions 7.0 fix_pack_28 Vulnerable ·Liferay
Show 106 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_30:*:*:*:*:*:*7.0 fix_pack_30VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_33:*:*:*:*:*:*7.0 fix_pack_33VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_35:*:*:*:*:*:*7.0 fix_pack_35VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_36:*:*:*:*:*:*7.0 fix_pack_36VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_39:*:*:*:*:*:*7.0 fix_pack_39VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_40:*:*:*:*:*:*7.0 fix_pack_40VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_41:*:*:*:*:*:*7.0 fix_pack_41VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_42:*:*:*:*:*:*7.0 fix_pack_42VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_43:*:*:*:*:*:*7.0 fix_pack_43VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_44:*:*:*:*:*:*7.0 fix_pack_44VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_45:*:*:*:*:*:*7.0 fix_pack_45VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_46:*:*:*:*:*:*7.0 fix_pack_46VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_47:*:*:*:*:*:*7.0 fix_pack_47VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_48:*:*:*:*:*:*7.0 fix_pack_48VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_49:*:*:*:*:*:*7.0 fix_pack_49VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_50:*:*:*:*:*:*7.0 fix_pack_50VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_51:*:*:*:*:*:*7.0 fix_pack_51VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_52:*:*:*:*:*:*7.0 fix_pack_52VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_53:*:*:*:*:*:*7.0 fix_pack_53VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_54:*:*:*:*:*:*7.0 fix_pack_54VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_56:*:*:*:*:*:*7.0 fix_pack_56VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_57:*:*:*:*:*:*7.0 fix_pack_57VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_58:*:*:*:*:*:*7.0 fix_pack_58VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_59:*:*:*:*:*:*7.0 fix_pack_59VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_60:*:*:*:*:*:*7.0 fix_pack_60VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_61:*:*:*:*:*:*7.0 fix_pack_61VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_64:*:*:*:*:*:*7.0 fix_pack_64VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_65:*:*:*:*:*:*7.0 fix_pack_65VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_66:*:*:*:*:*:*7.0 fix_pack_66VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_67:*:*:*:*:*:*7.0 fix_pack_67VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_68:*:*:*:*:*:*7.0 fix_pack_68VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_69:*:*:*:*:*:*7.0 fix_pack_69VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_70:*:*:*:*:*:*7.0 fix_pack_70VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_71:*:*:*:*:*:*7.0 fix_pack_71VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_72:*:*:*:*:*:*7.0 fix_pack_72VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_73:*:*:*:*:*:*7.0 fix_pack_73VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_75:*:*:*:*:*:*7.0 fix_pack_75VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_76:*:*:*:*:*:*7.0 fix_pack_76VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_78:*:*:*:*:*:*7.0 fix_pack_78VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_79:*:*:*:*:*:*7.0 fix_pack_79VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_80:*:*:*:*:*:*7.0 fix_pack_80VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_81:*:*:*:*:*:*7.0 fix_pack_81VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_82:*:*:*:*:*:*7.0 fix_pack_82VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_83:*:*:*:*:*:*7.0 fix_pack_83VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_84:*:*:*:*:*:*7.0 fix_pack_84VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_85:*:*:*:*:*:*7.0 fix_pack_85VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_86:*:*:*:*:*:*7.0 fix_pack_86VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_87:*:*:*:*:*:*7.0 fix_pack_87VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_88:*:*:*:*:*:*7.0 fix_pack_88VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_89:*:*:*:*:*:*7.0 fix_pack_89VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_90:*:*:*:*:*:*7.0 fix_pack_90VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_91:*:*:*:*:*:*7.0 fix_pack_91VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_92:*:*:*:*:*:*7.0 fix_pack_92VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_93:*:*:*:*:*:*7.0 fix_pack_93VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_94:*:*:*:*:*:*7.0 fix_pack_94VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_95:*:*:*:*:*:*7.0 fix_pack_95VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_96:*:*:*:*:*:*7.0 fix_pack_96VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_97:*:*:*:*:*:*7.0 fix_pack_97VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_98:*:*:*:*:*:*7.0 fix_pack_98VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_99:*:*:*:*:*:*7.0 fix_pack_99VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.1:-:*:*:*:*:*:*7.1VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_1:*:*:*:*:*:*7.1 fix_pack_1VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_10:*:*:*:*:*:*7.1 fix_pack_10VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_11:*:*:*:*:*:*7.1 fix_pack_11VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_12:*:*:*:*:*:*7.1 fix_pack_12VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_13:*:*:*:*:*:*7.1 fix_pack_13VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_14:*:*:*:*:*:*7.1 fix_pack_14VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_15:*:*:*:*:*:*7.1 fix_pack_15VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_16:*:*:*:*:*:*7.1 fix_pack_16VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_17:*:*:*:*:*:*7.1 fix_pack_17VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_18:*:*:*:*:*:*7.1 fix_pack_18VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_19:*:*:*:*:*:*7.1 fix_pack_19VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_2:*:*:*:*:*:*7.1 fix_pack_2VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_20:*:*:*:*:*:*7.1 fix_pack_20VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_21:*:*:*:*:*:*7.1 fix_pack_21VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_22:*:*:*:*:*:*7.1 fix_pack_22VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_23:*:*:*:*:*:*7.1 fix_pack_23VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_24:*:*:*:*:*:*7.1 fix_pack_24VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_25:*:*:*:*:*:*7.1 fix_pack_25VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_3:*:*:*:*:*:*7.1 fix_pack_3VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_4:*:*:*:*:*:*7.1 fix_pack_4VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_5:*:*:*:*:*:*7.1 fix_pack_5VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_6:*:*:*:*:*:*7.1 fix_pack_6VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_7:*:*:*:*:*:*7.1 fix_pack_7VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_8:*:*:*:*:*:*7.1 fix_pack_8VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_9:*:*:*:*:*:*7.1 fix_pack_9VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.2:-:*:*:*:*:*:*7.2VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_1:*:*:*:*:*:*7.2 fix_pack_1VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_10:*:*:*:*:*:*7.2 fix_pack_10VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_11:*:*:*:*:*:*7.2 fix_pack_11VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_12:*:*:*:*:*:*7.2 fix_pack_12VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_13:*:*:*:*:*:*7.2 fix_pack_13VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_14:*:*:*:*:*:*7.2 fix_pack_14VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_2:*:*:*:*:*:*7.2 fix_pack_2VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_3:*:*:*:*:*:*7.2 fix_pack_3VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_4:*:*:*:*:*:*7.2 fix_pack_4VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_5:*:*:*:*:*:*7.2 fix_pack_5VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_6:*:*:*:*:*:*7.2 fix_pack_6VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_7:*:*:*:*:*:*7.2 fix_pack_7VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_8:*:*:*:*:*:*7.2 fix_pack_8VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_9:*:*:*:*:*:*7.2 fix_pack_9VulnerableLiferay
cpe:2.3:a:liferay:dxp:7.3:-:*:*:*:*:*:*7.3VulnerableLiferay
cpe:2.3:a:liferay:dxp:7.3:sp1:*:*:*:*:*:*7.3 sp1VulnerableLiferay
cpe:2.3:a:liferay:dxp:7.3:sp2:*:*:*:*:*:*7.3 sp2VulnerableLiferay
cpe:2.3:a:liferay:dxp:7.3:sp3:*:*:*:*:*:*7.3 sp3VulnerableLiferay
cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*7.0.1 to before 7.4.2VulnerableLiferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_30:*:*:*:*:*:* Versions 7.0 fix_pack_30 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_33:*:*:*:*:*:* Versions 7.0 fix_pack_33 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_35:*:*:*:*:*:* Versions 7.0 fix_pack_35 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_36:*:*:*:*:*:* Versions 7.0 fix_pack_36 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_39:*:*:*:*:*:* Versions 7.0 fix_pack_39 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_40:*:*:*:*:*:* Versions 7.0 fix_pack_40 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_41:*:*:*:*:*:* Versions 7.0 fix_pack_41 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_42:*:*:*:*:*:* Versions 7.0 fix_pack_42 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_43:*:*:*:*:*:* Versions 7.0 fix_pack_43 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_44:*:*:*:*:*:* Versions 7.0 fix_pack_44 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_45:*:*:*:*:*:* Versions 7.0 fix_pack_45 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_46:*:*:*:*:*:* Versions 7.0 fix_pack_46 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_47:*:*:*:*:*:* Versions 7.0 fix_pack_47 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_48:*:*:*:*:*:* Versions 7.0 fix_pack_48 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_49:*:*:*:*:*:* Versions 7.0 fix_pack_49 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_50:*:*:*:*:*:* Versions 7.0 fix_pack_50 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_51:*:*:*:*:*:* Versions 7.0 fix_pack_51 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_52:*:*:*:*:*:* Versions 7.0 fix_pack_52 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_53:*:*:*:*:*:* Versions 7.0 fix_pack_53 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_54:*:*:*:*:*:* Versions 7.0 fix_pack_54 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_56:*:*:*:*:*:* Versions 7.0 fix_pack_56 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_57:*:*:*:*:*:* Versions 7.0 fix_pack_57 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_58:*:*:*:*:*:* Versions 7.0 fix_pack_58 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_59:*:*:*:*:*:* Versions 7.0 fix_pack_59 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_60:*:*:*:*:*:* Versions 7.0 fix_pack_60 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_61:*:*:*:*:*:* Versions 7.0 fix_pack_61 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_64:*:*:*:*:*:* Versions 7.0 fix_pack_64 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_65:*:*:*:*:*:* Versions 7.0 fix_pack_65 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_66:*:*:*:*:*:* Versions 7.0 fix_pack_66 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_67:*:*:*:*:*:* Versions 7.0 fix_pack_67 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_68:*:*:*:*:*:* Versions 7.0 fix_pack_68 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_69:*:*:*:*:*:* Versions 7.0 fix_pack_69 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_70:*:*:*:*:*:* Versions 7.0 fix_pack_70 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_71:*:*:*:*:*:* Versions 7.0 fix_pack_71 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_72:*:*:*:*:*:* Versions 7.0 fix_pack_72 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_73:*:*:*:*:*:* Versions 7.0 fix_pack_73 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_75:*:*:*:*:*:* Versions 7.0 fix_pack_75 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_76:*:*:*:*:*:* Versions 7.0 fix_pack_76 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_78:*:*:*:*:*:* Versions 7.0 fix_pack_78 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_79:*:*:*:*:*:* Versions 7.0 fix_pack_79 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_80:*:*:*:*:*:* Versions 7.0 fix_pack_80 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_81:*:*:*:*:*:* Versions 7.0 fix_pack_81 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_82:*:*:*:*:*:* Versions 7.0 fix_pack_82 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_83:*:*:*:*:*:* Versions 7.0 fix_pack_83 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_84:*:*:*:*:*:* Versions 7.0 fix_pack_84 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_85:*:*:*:*:*:* Versions 7.0 fix_pack_85 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_86:*:*:*:*:*:* Versions 7.0 fix_pack_86 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_87:*:*:*:*:*:* Versions 7.0 fix_pack_87 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_88:*:*:*:*:*:* Versions 7.0 fix_pack_88 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_89:*:*:*:*:*:* Versions 7.0 fix_pack_89 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_90:*:*:*:*:*:* Versions 7.0 fix_pack_90 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_91:*:*:*:*:*:* Versions 7.0 fix_pack_91 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_92:*:*:*:*:*:* Versions 7.0 fix_pack_92 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_93:*:*:*:*:*:* Versions 7.0 fix_pack_93 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_94:*:*:*:*:*:* Versions 7.0 fix_pack_94 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_95:*:*:*:*:*:* Versions 7.0 fix_pack_95 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_96:*:*:*:*:*:* Versions 7.0 fix_pack_96 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_97:*:*:*:*:*:* Versions 7.0 fix_pack_97 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_98:*:*:*:*:*:* Versions 7.0 fix_pack_98 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_99:*:*:*:*:*:* Versions 7.0 fix_pack_99 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.1:-:*:*:*:*:*:* Versions 7.1 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_1:*:*:*:*:*:* Versions 7.1 fix_pack_1 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_10:*:*:*:*:*:* Versions 7.1 fix_pack_10 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_11:*:*:*:*:*:* Versions 7.1 fix_pack_11 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_12:*:*:*:*:*:* Versions 7.1 fix_pack_12 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_13:*:*:*:*:*:* Versions 7.1 fix_pack_13 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_14:*:*:*:*:*:* Versions 7.1 fix_pack_14 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_15:*:*:*:*:*:* Versions 7.1 fix_pack_15 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_16:*:*:*:*:*:* Versions 7.1 fix_pack_16 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_17:*:*:*:*:*:* Versions 7.1 fix_pack_17 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_18:*:*:*:*:*:* Versions 7.1 fix_pack_18 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_19:*:*:*:*:*:* Versions 7.1 fix_pack_19 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_2:*:*:*:*:*:* Versions 7.1 fix_pack_2 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_20:*:*:*:*:*:* Versions 7.1 fix_pack_20 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_21:*:*:*:*:*:* Versions 7.1 fix_pack_21 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_22:*:*:*:*:*:* Versions 7.1 fix_pack_22 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_23:*:*:*:*:*:* Versions 7.1 fix_pack_23 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_24:*:*:*:*:*:* Versions 7.1 fix_pack_24 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_25:*:*:*:*:*:* Versions 7.1 fix_pack_25 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_3:*:*:*:*:*:* Versions 7.1 fix_pack_3 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_4:*:*:*:*:*:* Versions 7.1 fix_pack_4 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_5:*:*:*:*:*:* Versions 7.1 fix_pack_5 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_6:*:*:*:*:*:* Versions 7.1 fix_pack_6 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_7:*:*:*:*:*:* Versions 7.1 fix_pack_7 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_8:*:*:*:*:*:* Versions 7.1 fix_pack_8 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_9:*:*:*:*:*:* Versions 7.1 fix_pack_9 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.2:-:*:*:*:*:*:* Versions 7.2 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_1:*:*:*:*:*:* Versions 7.2 fix_pack_1 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_10:*:*:*:*:*:* Versions 7.2 fix_pack_10 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_11:*:*:*:*:*:* Versions 7.2 fix_pack_11 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_12:*:*:*:*:*:* Versions 7.2 fix_pack_12 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_13:*:*:*:*:*:* Versions 7.2 fix_pack_13 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_14:*:*:*:*:*:* Versions 7.2 fix_pack_14 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_2:*:*:*:*:*:* Versions 7.2 fix_pack_2 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_3:*:*:*:*:*:* Versions 7.2 fix_pack_3 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_4:*:*:*:*:*:* Versions 7.2 fix_pack_4 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_5:*:*:*:*:*:* Versions 7.2 fix_pack_5 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_6:*:*:*:*:*:* Versions 7.2 fix_pack_6 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_7:*:*:*:*:*:* Versions 7.2 fix_pack_7 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_8:*:*:*:*:*:* Versions 7.2 fix_pack_8 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_9:*:*:*:*:*:* Versions 7.2 fix_pack_9 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:dxp:7.3:-:*:*:*:*:*:* Versions 7.3 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:dxp:7.3:sp1:*:*:*:*:*:* Versions 7.3 sp1 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:dxp:7.3:sp2:*:*:*:*:*:* Versions 7.3 sp2 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:dxp:7.3:sp3:*:*:*:*:*:* Versions 7.3 sp3 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:* Versions 7.0.1 to before 7.4.2 Vulnerable ·Liferay

Remediation

  • Fix · GHSA-7m65-hmvg-rxpc com.liferay:com.liferay.site.memberships.web (Maven) Fixed in 5.0.10 Advisory →
  • Fix · GHSA-7m65-hmvg-rxpc com.liferay.portal:release.dxp.bom (Maven) Fixed in 7.0.10.fp102 Advisory →
  • Fix · GHSA-7m65-hmvg-rxpc com.liferay.portal:release.dxp.bom (Maven) Fixed in 7.1.10.fp26 Advisory →
  • Fix · GHSA-7m65-hmvg-rxpc com.liferay.portal:release.dxp.bom (Maven) Fixed in 7.2.10.fp15 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-28978
  2. 2026-10-03 Alias added: GHSA-7m65-hmvg-rxpc

References

Advisory 2

Other 6

  • TI-2023-22732 Cross-site scripting in Liferay DXP CVSS 3.1CRITICAL 9.6
  • TI-2022-20403 A SQL injection vulnerability in the Layout module in Liferay Portal 7.1.3 through… CVSS 3.1HIGH 8.8
  • TI-2025-03097 Uncontrolled resource consumption in Liferay Portal CVSS 4.0HIGH 8.7
  • TI-2025-03169 Uncontrolled resource consumption in Liferay Portal CVSS 4.0HIGH 8.7
  • TI-2024-17354 Cross-site scripting in Liferay Portal CVSS 3.1CRITICAL 9.6
  • TI-2024-16598 Cross-site scripting in Liferay Portal CVSS 3.1CRITICAL 9.6
See all 263 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences