CVE-2022-28978: 
Java vulnerability analysis and mitigation

A stored cross-site scripting (XSS) vulnerability was discovered in Liferay Portal's Site module's user membership administration page, affecting versions 7.0.1 through 7.4.1, and Liferay DXP 7.0 before fix pack 102, 7.1 before fix pack 26, 7.2 before fix pack 15, and 7.3 before service pack 3. The vulnerability was assigned identifier CVE-2022-28978 and was publicly disclosed on January 24, 2022 (Liferay Advisory).

The vulnerability allows remote attackers to inject arbitrary web script or HTML through a user's name in the Site module's user membership administration page. The vulnerability has been assigned a CVSS v3.1 base score of 5.4 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, indicating network accessibility, low attack complexity, required low privileges, and user interaction (NVD).

The successful exploitation of this vulnerability could allow attackers to execute arbitrary web scripts or HTML in the context of other users' browsers who access the affected administration page, potentially leading to unauthorized access to sensitive information or performing actions on behalf of other users (Liferay Advisory).

For Liferay Portal, version 7.4.2 includes a fix for this vulnerability. A January 2022 source patch is available for Liferay Portal 7.3.7. Users of Liferay Portal 7.0, 7.1, and 7.2 are advised to upgrade to Liferay Portal 7.4 as no direct fixes are available for these versions (Liferay Advisory).