CVE-2022-28980: 
Java vulnerability analysis and mitigation

Multiple cross-site scripting (XSS) vulnerabilities were discovered in Liferay Portal v7.4.3.4 and Liferay DXP v7.4 GA. The vulnerability allows attackers to execute arbitrary web scripts or HTML via parameters with the filter_ prefix (Liferay Advisory, NVD).

The vulnerability exists in the Fragment modules of Liferay Portal and affects parameters that have a filter_ prefix. It has been assigned a CVSS v3.1 base score of 6.1 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. This indicates that the vulnerability is network exploitable, requires low attack complexity, needs no privileges, but does require user interaction (NVD).

If successfully exploited, this vulnerability allows attackers to execute arbitrary web scripts or HTML in the context of the victim's browser. This could potentially lead to theft of sensitive data, session hijacking, or other malicious actions performed in the context of the affected user (NVD).

The vulnerability requires no special privileges to exploit but does need user interaction. The attack vector is network-accessible, and the attack complexity is considered low, making it relatively straightforward to exploit if a user can be convinced to interact with malicious content (NVD).

The vulnerability has been fixed in Liferay Portal version 7.4.3.5. Users of affected versions should upgrade to this version or later to mitigate the risk (Liferay Advisory).