Vulnerability DatabaseCVE-2022-42113
Mend.io Vulnerability Database
The largest open source vulnerability database
What is a Vulnerability ID?
New vulnerability? Tell us about it!
CVE-2022-42113
October 18, 2022
A Cross-site scripting (XSS) vulnerability in Document Library module in Liferay Portal 7.4.3.30 through 7.4.3.36, and Liferay DXP 7.4 update 30 through update 36 allows remote attackers to inject arbitrary web script or HTML via the "redirect" parameter.
Affected Packages
com.liferay:com.liferay.document.library.web (JAVA):
Affected version(s) >=1.0.0 <6.0.98
Fix Suggestion:
Update to version 6.0.98
com.liferay.portal:release.dxp.bom (JAVA):
Affected version(s) >=7.4.13.u30 <7.4.13.u37
Fix Suggestion:
Update to version 7.4.13.u37
Additional Notes
The description of this vulnerability differs from MITRE.
Related Resources (9)
https://liferay.atlassian.net/browse/LPE-17615
https://web.archive.org/web/20221019040338/https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42113
https://github.com/liferay/liferay-portal
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2022-42113?p_r_p_assetEntryId=121613062&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121613062%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse
https://nvd.nist.gov/vuln/detail/CVE-2022-42113
http://liferay.com
https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42113
https://github.com/liferay/liferay-portal/commit/62797d3ada6545b12fbfb86dbb229ac9d491d2c2
https://github.com/liferay/liferay-portal/commit/2e4d17dfe42bb3b12c96527943087cf7e4a7d57e
Do you need more information?
Contact Us
CVSS v4
Base Score:
5.3
Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
PASSIVE
Vulnerable System Confidentiality
LOW
Vulnerable System Integrity
LOW
Vulnerable System Availability
NONE
Subsequent System Confidentiality
LOW
Subsequent System Integrity
LOW
Subsequent System Availability
NONE
CVSS v3
Base Score:
6.1
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality
LOW
Integrity
LOW
Availability
NONE
Weakness Type (CWE)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79
EPSS
Base Score:
0.20