CVE-2022-38901

A Cross-site scripting (XSS) vulnerability in the Document and Media module – file upload functionality in Liferay Digital Experience Platform 7.3.10 SP3 allows remote attackers to inject arbitrary JS script or HTML into the description field of uploaded svg file.

Source: CVE-2022-38901