Missing SSL Certificate Validation in Liferay Dynamic Data Mapping Module
CVE-2022-42131

4.8MEDIUM

Key Information:

Vendor

Liferay
Status
Digital Experience Platform
Liferay Portal
Vendor
CVE Published:
15 November 2022

What is CVE-2022-42131?

Certain Liferay products exhibit a vulnerability due to missing SSL certificate validation within the Dynamic Data Mapping module's REST data providers. This flaw affects multiple versions of Liferay Portal and Liferay DXP, potentially allowing attackers to exploit unverified connections. Users are strongly advised to update to the latest fix packs to mitigate security risks.

References

http://liferay.com
https://portal.liferay.dev/learn/security/known-vulnerabi...
https://issues.liferay.com/browse/LPE-17377

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.