CVE-2022-42120

published 2022-11-15

CVE-2022-42120: A SQL injection vulnerability in the Fragment module in Liferay Portal 7.3.3 through 7.4.3.16, and Liferay DXP 7.3 before update 4, and 7.4 before update 17…

critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

A SQL injection vulnerability in the Fragment module in Liferay Portal 7.3.3 through 7.4.3.16, and Liferay DXP 7.3 before update 4, and 7.4 before update 17 allows attackers to execute arbitrary SQL commands via a PortletPreferences' `namespace` attribute.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
liferay	dxp	—	—
liferay	dxp	—	—
liferay	liferay_portal	7.3.3 – 7.4.3.16	—

CWE-89