PT-2022-26263 · Liferay · Liferay Portal+1

Published 2022-11-15 · Updated 2025-05-04 · CVE-2022-42118

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.1.0 through 7.4.2 Liferay DXP versions 7.1 before fix pack 27 Liferay DXP versions 7.2 before fix pack 15 Liferay DXP versions 7.3 before service pack 3

Description A Cross-site scripting (XSS) vulnerability in the Portal Search module allows remote attackers to inject arbitrary web script or HTML via the tag parameter. This issue enables attackers to execute malicious scripts on the client-side, potentially leading to unauthorized actions or data theft.

Recommendations For Liferay Portal versions 7.1.0 through 7.4.2, update to a version outside of this range to mitigate the risk. For Liferay DXP version 7.1, apply fix pack 27 or later. For Liferay DXP version 7.2, apply fix pack 15 or later. For Liferay DXP version 7.3, apply service pack 3 or later. As a temporary workaround, consider restricting access to the Portal Search module until a patch is available. Avoid using the tag parameter in the affected module until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-42118

GHSA-MR77-4PM4-X9VM

Affected Products

Liferay Dxp

Liferay Portal

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2022-42118 · Security Note
• https://issues.liferay.com/browse/LPE-17342 · Vendor Advisory
• http://liferay.com · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-42118 · Vendor Advisory
• https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42118 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mr77-4pm4-x9vm · Vendor Advisory
• https://github.com/liferay/liferay-portal · Note
• https://github.com/liferay/liferay-portal/commit/b42f1e70a69a31a3f2f7004a5b1923ec1e1e5445 · Note
• https://t.me/cvenotify/120321 · Telegram Post
• https://t.me/cvenotify/37716 · Telegram Post
• https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2022-42118?p_r_p_assetEntryId=121613298&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121613298%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse · Note
• https://twitter.com/pdnuclei_bot/status/1919134955533447665 · Twitter Post