CVE-2022-26593: 
Java vulnerability analysis and mitigation

A cross-site scripting (XSS) vulnerability was identified in Liferay Portal, tracked as CVE-2022-26593. The vulnerability affects the Asset module's asset categories selector in Liferay Portal versions 7.3.3 through 7.4.0, and Liferay DXP 7.3 before service pack 3. The vulnerability was discovered and reported by Duy Huynh, with the disclosure date being January 24, 2022 (Liferay Security).

The vulnerability is a stored cross-site scripting (XSS) issue that allows attackers to inject arbitrary web script or HTML through the name of an asset category. The severity of this vulnerability has been rated with a CVSS v3.1 score of 4.8 (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N), indicating moderate severity with network attack vector, low attack complexity, and requiring high privileges (Liferay Security).

The vulnerability allows remote attackers to inject malicious web scripts or HTML content through asset category names, potentially leading to the execution of unauthorized code in users' browsers when they interact with the affected asset categories selector (CERT-FR).

The vulnerability has been fixed in Liferay Portal version 7.4.1. For users running Liferay Portal 7.3.7, a source patch was made available in January 2022. Organizations are advised to upgrade to the fixed versions or apply the available source patch (Liferay Security).