CVE-2022-42110
published 2022-11-15CVE-2022-42110: A Cross-site scripting (XSS) vulnerability in the Announcements module in Liferay Portal 7.1.0 through 7.4.2, and Liferay DXP 7.1 before fix pack 27, 7.2…
PriorityP424medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
0.56%
43.1th percentile
A Cross-site scripting (XSS) vulnerability in the Announcements module in Liferay Portal 7.1.0 through 7.4.2, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 17, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| liferay | digital_experience_platform | — | — |
| liferay | digital_experience_platform | — | — |
| liferay | dxp | — | — |
| liferay | liferay_portal | 7.1.0 – 7.4.2 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Liferay Portal and Liferay DXP Vulnerable to XSS via the Announcements Module
osv·2022-11-15
CVE-2022-42110 [MEDIUM] Liferay Portal and Liferay DXP Vulnerable to XSS via the Announcements Module
Liferay Portal and Liferay DXP Vulnerable to XSS via the Announcements Module
A Cross-site scripting (XSS) vulnerability in the Announcements module before 6.0.11 from Liferay Portal (7.1.0 through 7.4.2), and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 17, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML.
GHSA
Liferay Portal and Liferay DXP Vulnerable to XSS via the Announcements Module
ghsa·2022-11-15
CVE-2022-42110 [MEDIUM] CWE-79 Liferay Portal and Liferay DXP Vulnerable to XSS via the Announcements Module
Liferay Portal and Liferay DXP Vulnerable to XSS via the Announcements Module
A Cross-site scripting (XSS) vulnerability in the Announcements module before 6.0.11 from Liferay Portal (7.1.0 through 7.4.2), and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 17, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://issues.liferay.com/browse/LPE-17403https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42110https://issues.liferay.com/browse/LPE-17403https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42110
2022-11-15
Published