PT-2022-26271 · Liferay · Liferay Portal+1

Published 2022-11-15 · Updated 2025-04-30 · CVE-2022-42125

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.4.3.5 through 7.4.3.35 Liferay DXP 7.4 update 1 through update 34

Description The issue allows attackers to create or overwrite existing files on the filesystem via the deployment of a malicious plugin/module. This is due to a zip slip vulnerability in FileUtil.unzip.

Recommendations For Liferay Portal versions 7.4.3.5 through 7.4.3.35, consider disabling the FileUtil.unzip function until a patch is available. For Liferay DXP 7.4 update 1 through update 34, restrict the deployment of plugins/modules to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BIT-LIFERAY-2022-42125

CVE-2022-42125

GHSA-G8HP-RC67-JF96

Affected Products

Liferay Dxp

Liferay Portal

References · 9

• https://osv.dev/vulnerability/CVE-2022-42125 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-42125 · Security Note
• https://osv.dev/vulnerability/GHSA-g8hp-rc67-jf96 · Vendor Advisory
• http://liferay.com · Vendor Advisory
• https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42125 · Vendor Advisory
• https://issues.liferay.com/browse/LPE-17517 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-liferay-2022-42125 · Vendor Advisory
• https://t.me/cvenotify/37711 · Telegram Post
• https://t.me/cvenotify/120323 · Telegram Post