CVE-2022-42122
published 2022-11-15CVE-2022-42122: A SQL injection vulnerability in the Friendly Url module in Liferay Portal 7.3.7, and Liferay DXP 7.3 fix pack 2 through update 4 allows attackers to execute…
PriorityP348critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.71%
49.6th percentile
A SQL injection vulnerability in the Friendly Url module in Liferay Portal 7.3.7, and Liferay DXP 7.3 fix pack 2 through update 4 allows attackers to execute arbitrary SQL commands via a crafted payload injected into the `title` field of a friendly URL.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| liferay | dxp | — | — |
| liferay | liferay_portal | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Friendly Portal/DXP Friendly URL sql injection
vuldb·2026-07-07·CVSS 9.8
CVE-2022-42122 [CRITICAL] Friendly Portal/DXP Friendly URL sql injection
A vulnerability has been found in Friendly Portal and DXP and classified as critical. Affected by this issue is some unknown functionality of the component Friendly URL Module. This manipulation causes sql injection.
This vulnerability appears as CVE-2022-42122. The attack may be initiated remotely. There is no available exploit.
GHSA
Liferay Portal and Liferay DXP Vulnerable to SQL Injection via Friendly URL Module
ghsa·2022-11-15
CVE-2022-42122 [CRITICAL] CWE-89 Liferay Portal and Liferay DXP Vulnerable to SQL Injection via Friendly URL Module
Liferay Portal and Liferay DXP Vulnerable to SQL Injection via Friendly URL Module
A SQL injection vulnerability in the Friendly Url module in Liferay Portal 7.3.7, and Liferay DXP 7.3 fix pack 2 through update 4 allows attackers to execute arbitrary SQL commands via a crafted payload injected into the `title` field of a friendly URL.
OSV
Liferay Portal and Liferay DXP Vulnerable to SQL Injection via Friendly URL Module
osv·2022-11-15
CVE-2022-42122 [CRITICAL] Liferay Portal and Liferay DXP Vulnerable to SQL Injection via Friendly URL Module
Liferay Portal and Liferay DXP Vulnerable to SQL Injection via Friendly URL Module
A SQL injection vulnerability in the Friendly Url module in Liferay Portal 7.3.7, and Liferay DXP 7.3 fix pack 2 through update 4 allows attackers to execute arbitrary SQL commands via a crafted payload injected into the `title` field of a friendly URL.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://issues.liferay.com/browse/LPE-17520https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42122https://issues.liferay.com/browse/LPE-17520https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42122
2022-11-15
Published