CVE-2022-42110: XSS

Q: What is CVE-2022-42110?

CVE-2022-42110 is a Cross-site scripting (XSS) vulnerability in the Announcements module in Liferay Portal 7.1.0 through 7.4.2, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 17, and 7.3 before service pack 3.

Q: How severe is CVE-2022-42110?

CVE-2022-42110 has a severity level of medium with a CVSS score of 6.1.

Q: What is affected by CVE-2022-42110?

CVE-2022-42110 affects Liferay Portal versions 7.1.0 through 7.4.2, Liferay DXP versions 7.1 before fix pack 27, 7.2 before fix pack 17, and 7.3 before service pack 3.

Q: How can remote attackers exploit CVE-2022-42110?

Remote attackers can exploit CVE-2022-42110 by injecting arbitrary web script or HTML using a Cross-site scripting (XSS) attack on the Announcements module in Liferay Portal and Liferay DXP.

Q: Are there any fixes available for CVE-2022-42110?

Yes, fixes are available for CVE-2022-42110. For Liferay Portal, upgrade to version 7.4.3 or apply the necessary fix pack. For Liferay DXP, upgrade to the corresponding fix pack or service pack depending on the version.

Published Nov 14, 2022

Updated

A Cross-site scripting (XSS) vulnerability in the Announcements module in Liferay Portal 7.1.0 through 7.4.2, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 17, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML.

Affected Software

88 affected components

Liferay Liferay Portal>=7.1.0<=7.4.2

Liferay DXP=7.1

Liferay DXP=7.1-fix_pack_1

Liferay DXP=7.1-fix_pack_10

Liferay DXP=7.1-fix_pack_11

Liferay DXP=7.1-fix_pack_12

Liferay DXP=7.1-fix_pack_13

Liferay DXP=7.1-fix_pack_14

Liferay DXP=7.1-fix_pack_15

Liferay DXP=7.1-fix_pack_16

Liferay DXP=7.1-fix_pack_17

Liferay DXP=7.1-fix_pack_18

Liferay DXP=7.1-fix_pack_19

Liferay DXP=7.1-fix_pack_2

Liferay DXP=7.1-fix_pack_20

Liferay DXP=7.1-fix_pack_21

Liferay DXP=7.1-fix_pack_22

Liferay DXP=7.1-fix_pack_23

Liferay DXP=7.1-fix_pack_24

Liferay DXP=7.1-fix_pack_25

Liferay DXP=7.1-fix_pack_3

Liferay DXP=7.1-fix_pack_4

Liferay DXP=7.1-fix_pack_5

Liferay DXP=7.1-fix_pack_6

Liferay DXP=7.1-fix_pack_7

Liferay DXP=7.1-fix_pack_8

Liferay DXP=7.1-fix_pack_9

Liferay DXP=7.2

Liferay DXP=7.2-fix_pack_1

Liferay DXP=7.2-fix_pack_10

Liferay DXP=7.2-fix_pack_11

Liferay DXP=7.2-fix_pack_12

Liferay DXP=7.2-fix_pack_13

Liferay DXP=7.2-fix_pack_14

Liferay DXP=7.2-fix_pack_15

Liferay DXP=7.2-fix_pack_2

Liferay DXP=7.2-fix_pack_3

Liferay DXP=7.2-fix_pack_4

Liferay DXP=7.2-fix_pack_5

Liferay DXP=7.2-fix_pack_6

Liferay DXP=7.2-fix_pack_7

Liferay DXP=7.2-fix_pack_8

Liferay DXP=7.2-fix_pack_9

Liferay DXP=7.3

Liferay DXP=7.3-sp1

Liferay DXP=7.3-sp2

Liferay Digital Experience Platform=7.1

Liferay Digital Experience Platform=7.1-fix_pack_1

Liferay Digital Experience Platform=7.1-fix_pack_10

Liferay Digital Experience Platform=7.1-fix_pack_11

Liferay Digital Experience Platform=7.1-fix_pack_12

Liferay Digital Experience Platform=7.1-fix_pack_13

Liferay Digital Experience Platform=7.1-fix_pack_14

Liferay Digital Experience Platform=7.1-fix_pack_15

Liferay Digital Experience Platform=7.1-fix_pack_16

Liferay Digital Experience Platform=7.1-fix_pack_17

Liferay Digital Experience Platform=7.1-fix_pack_18

Liferay Digital Experience Platform=7.1-fix_pack_19

Liferay Digital Experience Platform=7.1-fix_pack_2

Liferay Digital Experience Platform=7.1-fix_pack_20

Liferay Digital Experience Platform=7.1-fix_pack_21

Liferay Digital Experience Platform=7.1-fix_pack_22

Liferay Digital Experience Platform=7.1-fix_pack_23

Liferay Digital Experience Platform=7.1-fix_pack_24

Liferay Digital Experience Platform=7.1-fix_pack_25

Liferay Digital Experience Platform=7.1-fix_pack_3

Liferay Digital Experience Platform=7.1-fix_pack_4

Liferay Digital Experience Platform=7.1-fix_pack_5

Liferay Digital Experience Platform=7.1-fix_pack_6

Liferay Digital Experience Platform=7.1-fix_pack_7

Liferay Digital Experience Platform=7.1-fix_pack_8

Liferay Digital Experience Platform=7.1-fix_pack_9

Liferay Digital Experience Platform=7.2

Liferay Digital Experience Platform=7.2-fix_pack_1

Liferay Digital Experience Platform=7.2-fix_pack_10

Liferay Digital Experience Platform=7.2-fix_pack_11

Liferay Digital Experience Platform=7.2-fix_pack_12

Liferay Digital Experience Platform=7.2-fix_pack_13

Liferay Digital Experience Platform=7.2-fix_pack_14

Liferay Digital Experience Platform=7.2-fix_pack_15

Liferay Digital Experience Platform=7.2-fix_pack_2

Liferay Digital Experience Platform=7.2-fix_pack_3

Liferay Digital Experience Platform=7.2-fix_pack_4

Liferay Digital Experience Platform=7.2-fix_pack_5

Liferay Digital Experience Platform=7.2-fix_pack_6

Liferay Digital Experience Platform=7.2-fix_pack_7

Liferay Digital Experience Platform=7.2-fix_pack_8

Liferay Digital Experience Platform=7.2-fix_pack_9

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Liferay Portal/DEXP Announcements module to a version that resolves this vulnerability.
Fixed in 7.1.0 through 7.4.2

Event History

Nov 14, 2022

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Nov 15, 2022

Data Sourced

via NVD·12:15 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is CVE-2022-42110?

CVE-2022-42110 is a Cross-site scripting (XSS) vulnerability in the Announcements module in Liferay Portal 7.1.0 through 7.4.2, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 17, and 7.3 before service pack 3.

How severe is CVE-2022-42110?