PT-2022-26259 · Liferay · Liferay Portal+1

Published 2022-10-18 · Updated 2022-10-20 · CVE-2022-42114

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.4.0 through 7.4.3.36 Liferay DXP 7.4 before update 37

Description A Cross-site scripting (XSS) vulnerability in the Role module's edit role assignees page allows remote attackers to inject arbitrary web script or HTML. This issue affects the edit role assignees page, enabling attackers to execute malicious scripts.

Recommendations For Liferay Portal versions 7.4.0 through 7.4.3.36, update to a version after 7.4.3.36 to resolve the issue. For Liferay DXP 7.4 before update 37, apply update 37 or later to fix the vulnerability. As a temporary workaround, consider restricting access to the Role module's edit role assignees page until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-42114

GHSA-CMRW-CGFC-V6X2

Affected Products

Liferay Dxp

Liferay Portal

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2022-42114 · Security Note
• https://osv.dev/vulnerability/CVE-2022-42114 · Vendor Advisory
• https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42114 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cmrw-cgfc-v6x2 · Vendor Advisory
• https://github.com/liferay/liferay-portal · Note
• https://github.com/liferay/liferay-portal/commit/ba9a07ee8d1aa04a9da352e9b6a776313b8ce5e9 · Note
• https://liferay.atlassian.net/browse/LPE-17609 · Note
• https://t.me/cibsecurity/51727 · Telegram Post
• http://liferay.com · Note
• https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2022-42114?p_r_p_assetEntryId=121613086&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121613086%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse · Note
• https://web.archive.org/web/20221019022055/https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42114 · Note