CVE-2022-42118
published 2022-11-15CVE-2022-42118: A Cross-site scripting (XSS) vulnerability in the Portal Search module in Liferay Portal 7.1.0 through 7.4.2, and Liferay DXP 7.1 before fix pack 27, 7.2…
PriorityP431medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EXPLOIT
EPSS
0.90%
55.7th percentile
A Cross-site scripting (XSS) vulnerability in the Portal Search module in Liferay Portal 7.1.0 through 7.4.2, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 15, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the `tag` parameter.
Affected
45 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| liferay | digital_experience_platform | — | — |
| liferay | digital_experience_platform | — | — |
| liferay | digital_experience_platform | — | — |
| liferay | digital_experience_platform | — | — |
| liferay | digital_experience_platform | — | — |
| liferay | digital_experience_platform | — | — |
| liferay | digital_experience_platform | — | — |
| liferay | digital_experience_platform | — | — |
| liferay | digital_experience_platform | — | — |
| liferay | digital_experience_platform | — | — |
| liferay | digital_experience_platform | — | — |
| liferay | digital_experience_platform | — | — |
| liferay | digital_experience_platform | — | — |
| liferay | digital_experience_platform | — | — |
| liferay | digital_experience_platform | — | — |
| liferay | digital_experience_platform | — | — |
| liferay | digital_experience_platform | — | — |
| liferay | digital_experience_platform | — | — |
| liferay | digital_experience_platform | — | — |
| liferay | digital_experience_platform | — | — |
| liferay | digital_experience_platform | — | — |
| liferay | digital_experience_platform | — | — |
| liferay | digital_experience_platform | — | — |
| liferay | digital_experience_platform | — | — |
| liferay | digital_experience_platform | — | — |
Detection & IOCsextracted from sources · hover to see the quote
url/web/guest/home?p_p_id=com_liferay_portal_search_web_portlet_SearchPortlet&p_p_lifecycle=0&_com_liferay_portal_search_web_portlet_SearchPortlet_keywords=test&_com_liferay_portal_search_web_portlet_SearchPortlet_scope=this-site&_com_liferay_portal_search_web_portlet_SearchPortlet_assetTagNames=alert(document.domain)↗
- →Probe for reflected XSS via the `tag` parameter (assetTagNames) in the Portal Search portlet by sending a GET request to the search portlet URL and checking that the payload `alert(document.domain)` is reflected unescaped in the HTML response body with a 200 status and Content-Type: text/html. ↗
- →Identify exposed Liferay Portal instances via Shodan using the fingerprint `html:"var Liferay"` or FOFA using `body="var Liferay"` to scope attack surface before testing. ↗
- →Confirm exploitation by matching the reflected string `alert(document.domain)` in the response body AND the response header containing both `text/html` and `Liferay Portal`, with HTTP status 200. ↗
- →The vulnerable portlet identifier is `com_liferay_portal_search_web_portlet_SearchPortlet` with lifecycle `0`; monitor web logs for requests to this portlet containing script-like content in the `assetTagNames` parameter. ↗
- ·The vulnerability affects Liferay Portal 7.1.0 through 7.4.2 and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 15, and 7.3 before service pack 3. Detection probes should be scoped to these version ranges to avoid false positives on patched instances. ↗
- ·The XSS is reflected via the Portal Search module specifically; the injection point is the `assetTagNames` query parameter mapped to the `tag` parameter. Other search-related parameters in the same portlet are not confirmed vulnerable. ↗
- ·Exploitation requires user interaction (UI:R per CVSS), meaning the injected payload must be rendered in a victim's browser; server-side WAF rules blocking script content in the `assetTagNames` parameter will mitigate the attack vector. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Liferay Portal/DXP Portal Search day cross site scripting
vuldb·2026-07-05·CVSS 6.1
CVE-2022-42118 [MEDIUM] Liferay Portal/DXP Portal Search day cross site scripting
A vulnerability categorized as problematic has been discovered in Liferay Portal and DXP. This impacts an unknown function of the component Portal Search Module. Such manipulation of the argument day leads to cross site scripting.
This vulnerability is uniquely identified as CVE-2022-42118. The attack can be launched remotely. No exploit exists.
It is advisable to upgrade the affected component.
GHSA
Liferay Portal and Liferay DXP Vulnerable to XSS via the Portal Search Module
ghsa·2022-11-15
CVE-2022-42118 [MEDIUM] CWE-79 Liferay Portal and Liferay DXP Vulnerable to XSS via the Portal Search Module
Liferay Portal and Liferay DXP Vulnerable to XSS via the Portal Search Module
A Cross-site scripting (XSS) vulnerability in the Portal Search module before 6.0.12 from Liferay Portal (7.1.0 through 7.4.2), and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 15, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the `tag` parameter.
OSV
Liferay Portal and Liferay DXP Vulnerable to XSS via the Portal Search Module
osv·2022-11-15
CVE-2022-42118 [MEDIUM] Liferay Portal and Liferay DXP Vulnerable to XSS via the Portal Search Module
Liferay Portal and Liferay DXP Vulnerable to XSS via the Portal Search Module
A Cross-site scripting (XSS) vulnerability in the Portal Search module before 6.0.12 from Liferay Portal (7.1.0 through 7.4.2), and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 15, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the `tag` parameter.
No detection rules found.
Nuclei
Liferay Portal - Cross-site Scripting
nuclei·CVSS 6.1
CVE-2022-42118 [MEDIUM] Liferay Portal - Cross-site Scripting
Liferay Portal - Cross-site Scripting
A Cross-site scripting (XSS) vulnerability in the Portal Search module in Liferay Portal 7.1.0 through 7.4.2, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 15, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the `tag` parameter.
Template:
id: CVE-2022-42118
info:
name: Liferay Portal - Cross-site Scripting
author: ritikchaddha
severity: medium
description: |
A Cross-site scripting (XSS) vulnerability in the Portal Search module in Liferay Portal 7.1.0 through 7.4.2, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 15, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the `tag` parameter.
impact: |
Unauthenticated attackers can in
No writeups or analysis indexed.
https://issues.liferay.com/browse/LPE-17342https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42118https://issues.liferay.com/browse/LPE-17342https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42118
2022-11-15
Published