CVE-2022-38901

MediumCVSS 5.4/10Last modified Jul 9, 2026

Description

A Cross-site scripting (XSS) vulnerability in the Document and Media module - file upload functionality in Liferay Digital Experience Platform 7.3.10 SP3 allows remote attackers to inject arbitrary JS script or HTML into the description field of uploaded svg file.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Oct 19, 2022
Last modified
Jul 9, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-389025.4A Cross-site scripting (XSS) vulnerability in the Blog module - add new topic functionality in Liferay Digital Experience Platform 7.3.10 SPCVE-2022-38915.3The WP FullCalendar WordPress plugin before 1.5 does not ensure that the post retrieved via an AJAX action is public and can be accessed by CVE-2022-389169.8A file upload vulnerability exists in the storage feature of pagekit 1.0.18, which allows an attacker to upload malicious filesCVE-2022-38924.8The WP OAuth Server (OAuth Authentication) WordPress plugin before 4.2.2 does not sanitize and escape Client IDs, which could allow high priCVE-2022-389229.8BluePage CMS thru 3.9 processes an insufficiently sanitized HTTP Header Cookie value allowing MySQL Injection in the 'users-cookie-settings'CVE-2022-389239.8BluePage CMS thru v3.9 processes an insufficiently sanitized HTTP Header allowing MySQL Injection in the 'User-Agent' field using a Time-basCVE-2022-389287.8XPDF 4.04 is vulnerable to Null Pointer Dereference in FoFiType1C.cc:2393.CVE-2022-38934.8Cross-site Scripting (XSS) vulnerability in BlueSpiceCustomMenu extension of BlueSpice allows user with admin permissions to inject arbitrarCVE-2022-389318.8A Server-Side Request Forgery (SSRF) in fetch_net_file_upload function of baijiacmsV4 v4.1.4 allows remote attackers to force the applicatioCVE-2022-389327.8readelf in ToaruOS 2.0.1 has a global overflow allowing RCE when parsing a crafted ELF file.CVE-2022-389343.3readelf in ToaruOS 2.0.1 has some arbitrary address read vulnerabilities when parsing a crafted ELF file.CVE-2022-389358.8An issue was discovered in NiterForum version 2.5.0-beta in /src/main/java/cn/niter/forum/api/SsoApi.java and /src/main/java/cn/niter/forum/
CVE-2022-38901: Medium severity, CVSS 5.4 | Vulnix