CVE-2022-42118: XSS

Q: What is CVE-2022-42118?

CVE-2022-42118 is a Cross-site scripting (XSS) vulnerability in the Portal Search module in Liferay Portal 7.1.0 through 7.4.2, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 15, and 7.3 before service pack 3 that allows remote attackers to inject arbitrary web script or HTML via the tag parameter.

Q: Which software versions are affected by CVE-2022-42118?

CVE-2022-42118 affects Liferay Portal versions 7.1.0 through 7.4.2 and Liferay DXP versions 7.1 before fix pack 27, 7.2 before fix pack 15, and 7.3 before service pack 3.

Q: What is the severity of CVE-2022-42118?

The severity of CVE-2022-42118 is medium, with a CVSS score of 6.1.

Q: How can I fix CVE-2022-42118?

To fix CVE-2022-42118, upgrade Liferay Portal to version 7.4.3 or later, and Liferay DXP to version 7.1 fix pack 27 or later, 7.2 fix pack 15 or later, or 7.3 service pack 3 or later.

Q: Where can I find more information about CVE-2022-42118?

You can find more information about CVE-2022-42118 on the Liferay website, the Liferay issue tracker, and the Liferay security vulnerabilities page.

Published Nov 15, 2022

Updated

A Cross-site scripting (XSS) vulnerability in the Portal Search module in Liferay Portal 7.1.0 through 7.4.2, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 15, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the tag parameter.

Affected Software

86 affected components

Liferay Liferay Portal>=7.1.0<=7.4.2

Liferay DXP=7.1

Liferay DXP=7.1-fix_pack_1

Liferay DXP=7.1-fix_pack_10

Liferay DXP=7.1-fix_pack_11

Liferay DXP=7.1-fix_pack_12

Liferay DXP=7.1-fix_pack_13

Liferay DXP=7.1-fix_pack_14

Liferay DXP=7.1-fix_pack_15

Liferay DXP=7.1-fix_pack_16

Liferay DXP=7.1-fix_pack_17

Liferay DXP=7.1-fix_pack_18

Liferay DXP=7.1-fix_pack_19

Liferay DXP=7.1-fix_pack_2

Liferay DXP=7.1-fix_pack_20

Liferay DXP=7.1-fix_pack_21

Liferay DXP=7.1-fix_pack_22

Liferay DXP=7.1-fix_pack_23

Liferay DXP=7.1-fix_pack_24

Liferay DXP=7.1-fix_pack_25

Liferay DXP=7.1-fix_pack_3

Liferay DXP=7.1-fix_pack_4

Liferay DXP=7.1-fix_pack_5

Liferay DXP=7.1-fix_pack_6

Liferay DXP=7.1-fix_pack_7

Liferay DXP=7.1-fix_pack_8

Liferay DXP=7.1-fix_pack_9

Liferay DXP=7.2

Liferay DXP=7.2-fix_pack_1

Liferay DXP=7.2-fix_pack_10

Liferay DXP=7.2-fix_pack_11

Liferay DXP=7.2-fix_pack_12

Liferay DXP=7.2-fix_pack_13

Liferay DXP=7.2-fix_pack_14

Liferay DXP=7.2-fix_pack_2

Liferay DXP=7.2-fix_pack_3

Liferay DXP=7.2-fix_pack_4

Liferay DXP=7.2-fix_pack_5

Liferay DXP=7.2-fix_pack_6

Liferay DXP=7.2-fix_pack_7

Liferay DXP=7.2-fix_pack_8

Liferay DXP=7.2-fix_pack_9

Liferay DXP=7.3

Liferay DXP=7.3-sp1

Liferay DXP=7.3-sp2

Liferay Digital Experience Platform=7.1

Liferay Digital Experience Platform=7.1-fix_pack_1

Liferay Digital Experience Platform=7.1-fix_pack_10

Liferay Digital Experience Platform=7.1-fix_pack_11

Liferay Digital Experience Platform=7.1-fix_pack_12

Liferay Digital Experience Platform=7.1-fix_pack_13

Liferay Digital Experience Platform=7.1-fix_pack_14

Liferay Digital Experience Platform=7.1-fix_pack_15

Liferay Digital Experience Platform=7.1-fix_pack_16

Liferay Digital Experience Platform=7.1-fix_pack_17

Liferay Digital Experience Platform=7.1-fix_pack_18

Liferay Digital Experience Platform=7.1-fix_pack_19

Liferay Digital Experience Platform=7.1-fix_pack_2

Liferay Digital Experience Platform=7.1-fix_pack_20

Liferay Digital Experience Platform=7.1-fix_pack_21

Liferay Digital Experience Platform=7.1-fix_pack_22

Liferay Digital Experience Platform=7.1-fix_pack_23

Liferay Digital Experience Platform=7.1-fix_pack_24

Liferay Digital Experience Platform=7.1-fix_pack_25

Liferay Digital Experience Platform=7.1-fix_pack_3

Liferay Digital Experience Platform=7.1-fix_pack_4

Liferay Digital Experience Platform=7.1-fix_pack_5

Liferay Digital Experience Platform=7.1-fix_pack_6

Liferay Digital Experience Platform=7.1-fix_pack_7

Liferay Digital Experience Platform=7.1-fix_pack_8

Liferay Digital Experience Platform=7.1-fix_pack_9

Liferay Digital Experience Platform=7.2

Liferay Digital Experience Platform=7.2-fix_pack_1

Liferay Digital Experience Platform=7.2-fix_pack_10

Liferay Digital Experience Platform=7.2-fix_pack_11

Liferay Digital Experience Platform=7.2-fix_pack_12

Liferay Digital Experience Platform=7.2-fix_pack_13

Liferay Digital Experience Platform=7.2-fix_pack_14

Liferay Digital Experience Platform=7.2-fix_pack_2

Liferay Digital Experience Platform=7.2-fix_pack_3

Liferay Digital Experience Platform=7.2-fix_pack_4

Liferay Digital Experience Platform=7.2-fix_pack_5

Liferay Digital Experience Platform=7.2-fix_pack_6

Liferay Digital Experience Platform=7.2-fix_pack_7

Liferay Digital Experience Platform=7.2-fix_pack_8

Liferay Digital Experience Platform=7.2-fix_pack_9

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Liferay Portal (Portal Search module) to a version that resolves this vulnerability.
Fixed in 7.4.2
Upgrade
Upgrade Liferay Portal 7.1 to a version that resolves this vulnerability.
Patch fix pack 27
Upgrade
Upgrade Liferay Portal 7.2 to a version that resolves this vulnerability.
Patch fix pack 15
Upgrade
Upgrade Liferay Portal 7.3 to a version that resolves this vulnerability.
Patch service pack 3

Event History

Nov 15, 2022

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·01:15 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is CVE-2022-42118?

CVE-2022-42118 is a Cross-site scripting (XSS) vulnerability in the Portal Search module in Liferay Portal 7.1.0 through 7.4.2, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 15, and 7.3 before service pack 3 that allows remote attackers to inject arbitrary web script or HTML via the tag parameter.

Which software versions are affected by CVE-2022-42118?