PT-2022-26261 · Cksource+1 · Ckeditor+2

Published 2022-10-18 · Updated 2025-05-13 · CVE-2022-42116

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.3.2 through 7.4.3.14 Liferay DXP versions 7.3 before update 6 Liferay DXP versions 7.4 before update 15

Description A Cross-site scripting (XSS) issue exists due to the integration of the Frontend Editor module with CKEditor. This allows remote attackers to inject arbitrary web script or HTML via the name or namespace parameter.

Recommendations For Liferay Portal versions 7.3.2 through 7.4.3.14, update to a version outside of this range to resolve the issue. For Liferay DXP versions 7.3 before update 6, apply update 6 or later to fix the vulnerability. For Liferay DXP versions 7.4 before update 15, apply update 15 or later to fix the vulnerability. As a temporary workaround, consider restricting access to the CKEditor integration in the Frontend Editor module until a patch is available. Avoid using the name and namespace parameters in the affected module until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-42116

GHSA-67JP-27JJ-6X85

Affected Products

Ckeditor

Liferay Dxp

Liferay Portal

References · 11

• https://osv.dev/vulnerability/CVE-2022-42116 · Vendor Advisory
• https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42116 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-67jp-27jj-6x85 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-42116 · Security Note
• https://github.com/liferay/liferay-portal · Note
• https://github.com/liferay/liferay-portal/commit/ed2b59aa7db94c05c2be9ff5fda1d26ae7b00948 · Note
• https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2022-42116?p_r_p_assetEntryId=121613012&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121613012%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse · Note
• https://t.me/cvenotify/121949 · Telegram Post
• https://liferay.atlassian.net/browse/LPE-17480 · Note
• http://liferay.com · Note
• https://web.archive.org/web/20221019032312/https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42116 · Note