Cross-Site Scripting Vulnerability in Liferay Portal's Sort Widget
CVE-2022-42112

5.4MEDIUM

Key Information:

Vendor

Liferay
Status
Dxp
Liferay Portal
Vendor
CVE Published:
18 October 2022

What is CVE-2022-42112?

A Cross-site scripting (XSS) vulnerability exists in the Sort widget of the Portal Search module in Liferay Portal versions 7.2.0 to 7.4.3.24, as well as specific versions of Liferay DXP. This vulnerability enables remote attackers to execute arbitrary web scripts or HTML by injecting crafted payloads, potentially compromising user data and application security.

References

http://liferay.com
https://portal.liferay.dev/learn/security/known-vulnerabi...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.