CVE-2022-42112 — Cross-site Scripting in Digital Experience Platform

CWE-79 — Cross-site Scripting4 documents4 sources
Severity
5.4MEDIUMNVD
EPSS
0.2%
top 55.81%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Liferay Digital Experience PlatformLiferay PortalLiferay DXP
Timeline
PublishedOct 18
Latest updateOct 19

Description

A Cross-site scripting (XSS) vulnerability in the Portal Search module's Sort widget in Liferay Portal 7.2.0 through 7.4.3.24, and Liferay DXP 7.2 before fix pack 19, 7.3 before update 5, and DXP 7.4 before update 25 allows remote attackers to inject arbitrary web script or HTML via a crafted payload.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages3 packages

▶NVDliferay/liferay_portal7.2.0 — 7.4.3.25
▶NVDliferay/dxp7.3, 7.4+1

Patches

Patch: portal.liferay.dev ↗Patch: portal.liferay.dev ↗

🔴Vulnerability Details

3
OSV
Liferay Portal and Liferay DXP Vulnerable to XSS via the Portal Search Module↗2022-10-19
▶
GHSA
Liferay Portal and Liferay DXP Vulnerable to XSS via the Portal Search Module↗2022-10-19
▶
CVEList
CVE-2022-42112: A Cross-site scripting (XSS) vulnerability in the Portal Search module's Sort widget in Liferay Portal 7↗2022-10-18
▶
CVE-2022-42112 — Cross-site Scripting | cvebase