CVE-2022-28979
Liferay Portal and Liferay DXP Vulnerable to XSS in the Portal Search Module
Liferay Portal v7.1.0 through v7.4.2 and Liferay DXP 7.1 before fix pack 26, 7.2 before fix pack 15, and 7.3 before service pack 3 was discovered to contain a cross-site scripting (XSS) vulnerability in the Portal Search module's Custom Facet widget. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Custom Parameter Name text field.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Liferay Portal v7.1.0 through v7.4.2 and Liferay DXP 7.1 before fix pack 26, 7.2 before fix pack 15, and 7.3 before service pack 3 was discovered to contain a cross-site scripting (XSS) vulnerability in the Portal Search module's Custom Facet widget. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Custom Parameter Name text field.
- Record
CVE-2022-28979- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List
Liferay Portal v7.1.0 through v7.4.2 and Liferay DXP 7.1 before fix pack 26, 7.2 before fix pack 15, and 7.3 before service pack 3 was discovered to contain a cross-site scripting (XSS) vulnerability in the Portal Search module's Custom Facet widget. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Custom Parameter Name text field.
- Record
CVE-2022-28979- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2022-33410
Liferay Portal v7.1.0 through v7.4.2 and Liferay DXP 7.1 before fix pack 26, 7.2 before fix pack 15, and 7.3 before service pack 3 was discovered to contain a cross-site scripting (XSS) vulnerability in the Portal Search module's Custom Facet widget. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Custom Parameter Name text field.
- Record
EUVD-2022-33410- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-7r3w-wggm-pjwf
Liferay Portal and Liferay DXP Vulnerable to XSS in the Portal Search Module
In Search Web before v6.0.19 in Liferay Portal (v7.1.0 through v7.4.2) and Liferay DXP 7.1 before fix pack 26, 7.2 before fix pack 15, and 7.3 before service pack 3 was discovered to contain a cross-site scripting (XSS) vulnerability in the Portal Search module's Custom Facet widget. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Custom Parameter Name text field.
- Record
GHSA-7r3w-wggm-pjwf- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
Liferay Portal v7.1.0 through v7.4.2 and Liferay DXP 7.1 before fix pack 26, 7.2 before fix pack 15, and 7.3 before service pack 3 was discovered to contain a cross-site scripting (XSS) vulnerability in the Portal Search module's Custom Facet widget. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Custom Parameter Name text field.
- Record
CVE-2022-28979- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-7r3w-wggm-pjwf
Liferay Portal and Liferay DXP Vulnerable to XSS in the Portal Search Module
In Search Web before v6.0.19 in Liferay Portal (v7.1.0 through v7.4.2) and Liferay DXP 7.1 before fix pack 26, 7.2 before fix pack 15, and 7.3 before service pack 3 was discovered to contain a cross-site scripting (XSS) vulnerability in the Portal Search module's Custom Facet widget. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Custom Parameter Name text field.
- Record
GHSA-7r3w-wggm-pjwf- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
com.liferay:com.liferay.portal.search.webMaven |
before 6.0.19 | 6.0.19 |
com.liferay.portal:release.dxp.bomMaven |
7.1.0 up to 7.1.10.fp26 | 7.1.10.fp26 |
com.liferay.portal:release.dxp.bomMaven |
7.2.0 up to 7.2.10.fp15 | 7.2.10.fp15 |
com.liferay:com.liferay.portal.search.webMaven |
before 6.0.19, plus listed versions 1.0.01.0.11.0.21.0.31.0.4 Show 45 moreShow less1.1.01.1.11.1.101.1.111.1.121.1.131.1.141.1.151.1.161.1.171.1.181.1.191.1.21.1.201.1.211.1.221.1.31.1.41.1.51.1.61.1.71.1.81.1.91.2.01.2.11.2.21.2.31.2.41.2.51.3.01.3.11.3.21.3.31.3.41.3.51.3.61.3.71.3.81.3.92.0.02.0.12.0.102.0.112.0.122.0.13 |
6.0.19 |
com.liferay.portal:release.dxp.bomMaven |
7.1.0 and later, plus listed versions 2023.q3.12023.q3.102023.q3.22023.q3.32023.q3.4 Show 45 moreShow less2023.q3.52023.q3.62023.q3.72023.q3.82023.q3.92023.q4.02023.q4.12023.q4.102023.q4.22023.q4.32023.q4.42023.q4.52023.q4.62023.q4.72023.q4.82023.q4.92024.q1.12024.q1.102024.q1.112024.q1.122024.q1.132024.q1.142024.q1.152024.q1.162024.q1.172024.q1.182024.q1.22024.q1.32024.q1.42024.q1.52024.q1.62024.q1.72024.q1.82024.q1.92024.q2.02024.q2.12024.q2.102024.q2.112024.q2.122024.q2.132024.q2.22024.q2.32024.q2.42024.q2.52024.q2.6 |
None known |
com.liferay.portal:release.dxp.bomMaven |
7.2.0 and later, plus listed versions 2023.q3.12023.q3.102023.q3.22023.q3.32023.q3.4 Show 45 moreShow less2023.q3.52023.q3.62023.q3.72023.q3.82023.q3.92023.q4.02023.q4.12023.q4.102023.q4.22023.q4.32023.q4.42023.q4.52023.q4.62023.q4.72023.q4.82023.q4.92024.q1.12024.q1.102024.q1.112024.q1.122024.q1.132024.q1.142024.q1.152024.q1.162024.q1.172024.q1.182024.q1.22024.q1.32024.q1.42024.q1.52024.q1.62024.q1.72024.q1.82024.q1.92024.q2.02024.q2.12024.q2.102024.q2.112024.q2.122024.q2.132024.q2.22024.q2.32024.q2.42024.q2.52024.q2.6 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-28979 is a medium vulnerability (CVSS 6.1) in Liferay Dxp, published September 21, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.53%, the 45th percentile. Fixed in com.liferay:com.liferay.portal.search.web 6.0.19.
References
portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-28979-xss-in-custom-facet-widget
issues.liferay.com/browse/LPE-17381
nvd.nist.gov/vuln/detail/CVE-2022-28979
liferay.com
github.com/liferay/liferay-portal/commit/e18065248673c77927f4839439aa200bfb965ced
liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2022-28979-xss-in-custom-facet-widget?p_r_p_assetEntryId=121612377&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121612377%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse
Left out here: 1,022 versions. The JSON record has them.