PT-2022-26262 · Liferay · Liferay Portal+1

Published 2022-10-18 · Updated 2025-05-12 · CVE-2022-42117

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.3.2 through 7.4.3.16 Liferay DXP versions 7.3 before update 6, and 7.4 before update 17

Description A Cross-site scripting (XSS) issue in the Frontend Taglib module allows remote attackers to inject arbitrary web script or HTML. This can lead to the execution of malicious code on the client-side.

Recommendations For Liferay Portal versions 7.3.2 through 7.4.3.16, update to a version outside of the affected range. For Liferay DXP version 7.3, apply update 6 or later. For Liferay DXP version 7.4, apply update 17 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-42117

GHSA-G6R2-6X46-JPP6

Affected Products

Liferay Dxp

Liferay Portal

References · 11

• https://osv.dev/vulnerability/GHSA-g6r2-6x46-jpp6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-42117 · Security Note
• https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42117 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-42117 · Vendor Advisory
• https://github.com/liferay/liferay-portal · Note
• https://github.com/liferay/liferay-portal/commit/a0d25a757f002c39d02b93938bc11feb3b0de6f6 · Note
• https://web.archive.org/web/20221205223431/https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42117 · Note
• https://t.me/cvenotify/121785 · Telegram Post
• https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2022-42117?p_r_p_assetEntryId=121613244&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121613244%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse · Note
• https://liferay.atlassian.net/browse/LPE-17497 · Note
• http://liferay.com · Note