Cross-Site Scripting Vulnerability in Liferay Portal and DXP
CVE-2022-42110

6.1MEDIUM

Key Information:

Vendor

Liferay
Status
Liferay Portal
Vendor
CVE Published:
15 November 2022

What is CVE-2022-42110?

The vulnerability allows remote attackers to exploit the Announcements module in Liferay Portal versions 7.1.0 through 7.4.2 and Liferay DXP 7.1 (before specific fix packs). By injecting arbitrary web scripts or HTML, malicious users can execute harmful actions in the context of authenticated users, leading to information theft, session hijacking, and further attacks within the vulnerable environment. It is crucial for organizations using these versions to apply recommended updates and patches to mitigate potential risks.

References

https://portal.liferay.dev/learn/security/known-vulnerabi...
https://issues.liferay.com/browse/LPE-17403

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.