CVE-2022-42111: XSS

Q: What is the severity of CVE-2022-42111?

The severity of CVE-2022-42111 is medium with a CVSS score of 5.4.

Q: How does CVE-2022-42111 affect Liferay Portal and Liferay DXP?

CVE-2022-42111 affects Liferay Portal versions 7.2.1 through 7.4.2 and Liferay DXP versions 7.2 before fix pack 19 and 7.3 before update 4.

Q: How can remote attackers exploit CVE-2022-42111?

Remote attackers can exploit CVE-2022-42111 by sharing an asset with a crafted payload to inject arbitrary web script or HTML.

Q: What is the Common Weakness Enumeration (CWE) ID for CVE-2022-42111?

The Common Weakness Enumeration (CWE) ID for CVE-2022-42111 is CWE-79.

Q: How can I fix CVE-2022-42111?

To fix CVE-2022-42111, update to Liferay Portal version 7.4.3 or higher, and Liferay DXP version 7.2 fix pack 19 or higher, or version 7.3 update 4 or higher.

Published Nov 15, 2022

Updated

A Cross-site scripting (XSS) vulnerability in the Sharing module's user notification in Liferay Portal 7.2.1 through 7.4.2, and Liferay DXP 7.2 before fix pack 19, and 7.3 before update 4 allows remote attackers to inject arbitrary web script or HTML by sharing an asset with a crafted payload.

Affected Software

37 affected components

Liferay Liferay Portal>=7.2.1<=7.4.2

Liferay DXP=7.2

Liferay DXP=7.2-fix_pack_1

Liferay DXP=7.2-fix_pack_10

Liferay DXP=7.2-fix_pack_11

Liferay DXP=7.2-fix_pack_12

Liferay DXP=7.2-fix_pack_13

Liferay DXP=7.2-fix_pack_14

Liferay DXP=7.2-fix_pack_15

Liferay DXP=7.2-fix_pack_2

Liferay DXP=7.2-fix_pack_3

Liferay DXP=7.2-fix_pack_4

Liferay DXP=7.2-fix_pack_5

Liferay DXP=7.2-fix_pack_6

Liferay DXP=7.2-fix_pack_7

Liferay DXP=7.2-fix_pack_8

Liferay DXP=7.2-fix_pack_9

Liferay DXP=7.3

Liferay DXP=7.3-update_1

Liferay DXP=7.3-update_2

Liferay DXP=7.3-update_3

Liferay Digital Experience Platform=7.2

Liferay Digital Experience Platform=7.2-fix_pack_1

Liferay Digital Experience Platform=7.2-fix_pack_10

Liferay Digital Experience Platform=7.2-fix_pack_11

Liferay Digital Experience Platform=7.2-fix_pack_12

Liferay Digital Experience Platform=7.2-fix_pack_13

Liferay Digital Experience Platform=7.2-fix_pack_14

Liferay Digital Experience Platform=7.2-fix_pack_15

Liferay Digital Experience Platform=7.2-fix_pack_2

Liferay Digital Experience Platform=7.2-fix_pack_3

Liferay Digital Experience Platform=7.2-fix_pack_4

Liferay Digital Experience Platform=7.2-fix_pack_5

Liferay Digital Experience Platform=7.2-fix_pack_6

Liferay Digital Experience Platform=7.2-fix_pack_7

Liferay Digital Experience Platform=7.2-fix_pack_8

Liferay Digital Experience Platform=7.2-fix_pack_9

Event History

Nov 15, 2022

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·01:15 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2022-42111?

The severity of CVE-2022-42111 is medium with a CVSS score of 5.4.

How does CVE-2022-42111 affect Liferay Portal and Liferay DXP?

CVE-2022-42111 affects Liferay Portal versions 7.2.1 through 7.4.2 and Liferay DXP versions 7.2 before fix pack 19 and 7.3 before update 4.

How can remote attackers exploit CVE-2022-42111?