PT-2022-26267 · Liferay · Liferay Portal+1

Published 2022-11-15 · Updated 2025-09-05 · CVE-2022-42121

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.1.3 through 7.4.3.4 Liferay DXP 7.1 before fix pack 27 Liferay DXP 7.2 before fix pack 17 Liferay DXP 7.3 before service pack 3 Liferay DXP 7.4 GA

Description A SQL injection issue in the Layout module allows remote authenticated attackers to execute arbitrary SQL commands via a crafted payload injected into a page template's Name field.

Recommendations For Liferay Portal versions 7.1.3 through 7.4.3.4, update to a version outside of this range to mitigate the risk. For Liferay DXP 7.1, apply fix pack 27 or later. For Liferay DXP 7.2, apply fix pack 17 or later. For Liferay DXP 7.3, apply service pack 3 or later. For Liferay DXP 7.4 GA, consider upgrading to a later version or service pack that includes the necessary security fixes. As a temporary workaround, consider restricting access to the Layout module or limiting the ability to inject payloads into page templates until a patch is available.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2022-42121

GHSA-GXXJ-FHMR-37J9

Affected Products

Liferay Dxp

Liferay Portal

References · 15

• https://nvd.nist.gov/vuln/detail/CVE-2022-42121 · Security Note
• https://issues.liferay.com/browse/LPE-17414 · Vendor Advisory
• http://liferay.com · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-42121 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gxxj-fhmr-37j9 · Vendor Advisory
• https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42121 · Vendor Advisory
• https://github.com/liferay/liferay-portal · Note
• https://github.com/liferay/liferay-portal/commit/5a17acb714c57e36695b7caff8e6a2789e2cf9d0 · Note
• https://github.com/liferay/liferay-portal/commit/f245f4b428186c8e5964a9ffe90ccc7e12cf7f66 · Note
• https://github.com/liferay/liferay-portal/commit/14c8fbbac814c0b511b4f3ade19eafb2182923c7 · Note
• https://github.com/liferay/liferay-portal/commit/82de94e9f3a4425e3ee6c187462d670ae9bfef51 · Note
• https://t.me/cveNotify/134479 · Telegram Post
• https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2022-42121?p_r_p_assetEntryId=121613426&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121613426%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse · Note
• https://t.me/cvenotify/37714 · Telegram Post
• https://t.me/cvenotify/37965 · Telegram Post