CVE-2022-28978
Liferay Portal and Liferay DXP Vulnerable to XSS in the Site Module
Stored cross-site scripting (XSS) vulnerability in the Site module's user membership administration page in Liferay Portal 7.0.1 through 7.4.1, and Liferay DXP 7.0 before fix pack 102, 7.1 before fix pack 26, 7.2 before fix pack 15, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the a user's name.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Stored cross-site scripting (XSS) vulnerability in the Site module's user membership administration page in Liferay Portal 7.0.1 through 7.4.1, and Liferay DXP 7.0 before fix pack 102, 7.1 before fix pack 26, 7.2 before fix pack 15, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the a user's name.
- Record
CVE-2022-28978- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List
Stored cross-site scripting (XSS) vulnerability in the Site module's user membership administration page in Liferay Portal 7.0.1 through 7.4.1, and Liferay DXP 7.0 before fix pack 102, 7.1 before fix pack 26, 7.2 before fix pack 15, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the a user's name.
- Record
CVE-2022-28978- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2022-33409
Stored cross-site scripting (XSS) vulnerability in the Site module's user membership administration page in Liferay Portal 7.0.1 through 7.4.1, and Liferay DXP 7.0 before fix pack 102, 7.1 before fix pack 26, 7.2 before fix pack 15, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the a user's name.
- Record
EUVD-2022-33409- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-7m65-hmvg-rxpc
Liferay Portal and Liferay DXP Vulnerable to XSS in the Site Module
Stored cross-site scripting (XSS) vulnerability in the Site module's user membership administration page in Liferay Site Memberships Web before 5.0.10 from Liferay Portal (7.0.1 through 7.4.1), and Liferay DXP 7.0 before fix pack 102, 7.1 before fix pack 26, 7.2 before fix pack 15, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the a user's name.
- Record
GHSA-7m65-hmvg-rxpc- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
Stored cross-site scripting (XSS) vulnerability in the Site module's user membership administration page in Liferay Portal 7.0.1 through 7.4.1, and Liferay DXP 7.0 before fix pack 102, 7.1 before fix pack 26, 7.2 before fix pack 15, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the a user's name.
- Record
CVE-2022-28978- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-7m65-hmvg-rxpc
Liferay Portal and Liferay DXP Vulnerable to XSS in the Site Module
Stored cross-site scripting (XSS) vulnerability in the Site module's user membership administration page in Liferay Site Memberships Web before 5.0.10 from Liferay Portal (7.0.1 through 7.4.1), and Liferay DXP 7.0 before fix pack 102, 7.1 before fix pack 26, 7.2 before fix pack 15, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the a user's name.
- Record
GHSA-7m65-hmvg-rxpc- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
com.liferay:com.liferay.site.memberships.webMaven |
before 5.0.10 | 5.0.10 |
com.liferay.portal:release.dxp.bomMaven |
7.0.0 up to 7.0.10.fp102 | 7.0.10.fp102 |
com.liferay.portal:release.dxp.bomMaven |
7.1.0 up to 7.1.10.fp26 | 7.1.10.fp26 |
com.liferay.portal:release.dxp.bomMaven |
7.2.0 up to 7.2.10.fp15 | 7.2.10.fp15 |
com.liferay:com.liferay.site.memberships.webMaven |
before 5.0.10, plus listed versions 1.0.01.0.11.0.101.0.111.0.12 Show 45 moreShow less1.0.131.0.141.0.151.0.161.0.171.0.181.0.191.0.21.0.201.0.211.0.221.0.231.0.241.0.251.0.261.0.271.0.281.0.291.0.31.0.301.0.311.0.321.0.331.0.341.0.351.0.361.0.371.0.381.0.391.0.41.0.401.0.411.0.421.0.431.0.441.0.451.0.461.0.471.0.481.0.491.0.51.0.501.0.511.0.521.0.53 |
5.0.10 |
com.liferay.portal:release.dxp.bomMaven |
7.0.0 up to 7.0.10.fp102, plus listed versions 7.0.10.fp1007.0.10.fp1017.0.10.fp607.0.10.fp617.0.10.fp62 Show 40 moreShow less7.0.10.fp637.0.10.fp647.0.10.fp657.0.10.fp667.0.10.fp677.0.10.fp687.0.10.fp697.0.10.fp707.0.10.fp717.0.10.fp727.0.10.fp737.0.10.fp747.0.10.fp757.0.10.fp767.0.10.fp777.0.10.fp787.0.10.fp797.0.10.fp807.0.10.fp817.0.10.fp827.0.10.fp837.0.10.fp847.0.10.fp857.0.10.fp85-17.0.10.fp867.0.10.fp86-17.0.10.fp877.0.10.fp87-17.0.10.fp887.0.10.fp897.0.10.fp907.0.10.fp917.0.10.fp927.0.10.fp947.0.10.fp94-17.0.10.fp957.0.10.fp95-17.0.10.fp95-27.0.10.fp977.0.10.fp98 |
7.0.10.fp102 |
com.liferay.portal:release.dxp.bomMaven |
7.1.0 up to 7.1.10.fp26, plus listed versions 7.1.107.1.10.fp17.1.10.fp107.1.10.fp117.1.10.fp12 Show 19 moreShow less7.1.10.fp137.1.10.fp147.1.10.fp157.1.10.fp167.1.10.fp177.1.10.fp187.1.10.fp197.1.10.fp27.1.10.fp207.1.10.fp227.1.10.fp247.1.10.fp257.1.10.fp37.1.10.fp47.1.10.fp57.1.10.fp67.1.10.fp77.1.10.fp87.1.10.fp9 |
7.1.10.fp26 |
com.liferay.portal:release.dxp.bomMaven |
7.2.0 up to 7.2.10.fp15, plus listed versions 7.2.17.2.107.2.10.fp17.2.10.fp1-17.2.10.fp10 Show 12 moreShow less7.2.10.fp117.2.10.fp127.2.10.fp137.2.10.fp147.2.10.fp27.2.10.fp37.2.10.fp47.2.10.fp57.2.10.fp67.2.10.fp77.2.10.fp87.2.10.fp9 |
7.2.10.fp15 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-28978 is a medium vulnerability (CVSS 5.4) in Liferay Dxp, published September 21, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.68%, the 52nd percentile. Fixed in com.liferay:com.liferay.site.memberships.web 5.0.10.
References
portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-28978-stored-xss-with-user-name-in-site-membership
nvd.nist.gov/vuln/detail/CVE-2022-28978
liferay.com
github.com/liferay/liferay-portal/commit/ffdc9d1f8abf484598afdc51671a30533740c16d
liferay.atlassian.net/browse/LPE-17332
liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2022-28978-stored-xss-with-user-name-in-site-membership?p_r_p_assetEntryId=121612301&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121612301%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse
Show 4 moreShow less
web.archive.org/web/20220922015759/https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-28978-stored-xss-with-user-name-in-site-membership
Left out here: 228 versions. The JSON record has them.