PT-2022-26266 · Liferay · Liferay Portal+1
CVE-2022-42120
·
Published
2022-11-15
·
Updated
2025-09-05
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Liferay Portal versions 7.3.3 through 7.4.3.16
Liferay DXP versions 7.3 before update 4
Liferay DXP versions 7.4 before update 17
Description
A SQL injection issue in the Fragment module allows attackers to execute arbitrary SQL commands via a PortletPreferences'
namespace attribute. This enables attackers to manipulate database queries, potentially leading to unauthorized data access or modification.Recommendations
For Liferay Portal versions 7.3.3 through 7.4.3.16, update to a version outside of this range to resolve the issue.
For Liferay DXP versions 7.3 before update 4, apply update 4 or later to fix the vulnerability.
For Liferay DXP versions 7.4 before update 17, apply update 17 or later to fix the vulnerability.
As a temporary workaround, consider restricting access to the Fragment module until a patch is available. Avoid using the
namespace attribute in the PortletPreferences until the issue is resolved.Exploit
Fix
SQL injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Liferay Dxp
Liferay Portal