CVE-2022-42118
Liferay Portal and Liferay DXP Vulnerable to XSS via the Portal Search Module
6.1
MEDIUM
CVSS 3.1
EPSS 13.2%
Description
A Cross-site scripting (XSS) vulnerability in the Portal Search module before 6.0.12 from Liferay Portal (7.1.0 through 7.4.2), and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 15, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the `tag` parameter.
How to fix CVE-2022-42118
To remediate CVE-2022-42118, upgrade the affected package to a fixed version below.
- —upgrade to 6.0.12 or later
- —upgrade to 7.1.10.fp27 or later
Is CVE-2022-42118 being exploited?
Moderate — EPSS is 13.2%. Track this CVE but it's not at the top of the prioritisation list.
Affected packages (2)
- from 0, < 6.0.12
- >= 7.1.0, < 7.1.10.fp27
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | MEDIUM6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |