Security readout for executives and security teams
Plain-English summary
This is a stored cross-site scripting issue in Liferay category handling. An attacker could place malicious script or HTML in an asset category name, causing it to run when users view the affected category selector. Business risk depends on who can create categories and which users view them.
Executive priority
Treat as a timely remediation item for affected Liferay systems, especially public or multi-user portals. It is not confirmed as actively exploited in the provided sources, but stored XSS can undermine trusted user sessions and portal integrity.
Technical view
CVE-2022-26593 affects Liferay Portal 7.3.3 through 7.4.0 and Liferay DXP 7.3 before service pack 3. The vulnerable Asset module asset categories selector does not safely handle asset category names, enabling stored XSS through category name content.
Likely exposure
Exposure is most likely in Liferay Portal or DXP deployments using the Asset module and asset categories selector on affected versions. Internet-facing administration or content workflows may increase practical risk.
Exploitation context
The bundle does not show CISA KEV listing or another cited source confirming active exploitation. The vulnerability is remotely triggerable according to the CVE description, but exploit prevalence is not evidenced here.
Researcher notes
The provided data lacks CVSS, CWE, exploit telemetry, and detailed fixed-version mapping for Liferay Portal. Analysis should stay tied to the named affected ranges and the vendor advisory until additional public evidence is reviewed.
Mitigation direction
- Upgrade Liferay DXP 7.3 to service pack 3 or later where applicable.
- For Liferay Portal, check Liferay’s advisory for the fixed release path.
- Restrict asset category creation and editing to trusted roles.
- Review existing category names for unexpected HTML or script-like content.
- Monitor vendor guidance for any additional mitigation or backport details.
Validation and detection
- Inventory all Liferay Portal and DXP versions in production and staging.
- Confirm whether Liferay Portal is 7.3.3 through 7.4.0.
- Confirm whether Liferay DXP 7.3 is below service pack 3.
- Identify workflows where users can create or edit asset categories.
- Review logs and content records for suspicious category-name changes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-26593 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.