CVE-2022-42122: SQL Injection
A SQL injection vulnerability in the Friendly Url module in Liferay Portal 7.3.7, and Liferay DXP 7.3 fix pack 2 through update 4 allows attackers to execute arbitrary SQL commands via a crafted payload injected into the title field of a friendly URL.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/com.liferay:com.liferay.friendly.url.serviceto a version that resolves this vulnerability.Fixed in 4.0.3 - Upgrade
Upgrade
maven/com.liferay.portal:release.dxp.bomto a version that resolves this vulnerability.Fixed in 7.3.10.u4 - Upgrade
Upgrade
maven/com.liferay.portal:release.portal.bomto a version that resolves this vulnerability.Fixed in 7.4.0-ga1 - Upgrade
Upgrade
Liferay Portal 7.3.7 / Liferay DXP 7.3to a version that resolves this vulnerability.Fixed in 7.3.7Patch Liferay DXP 7.3 fix pack 2 through update 4 - Compensating control
Restrict or sanitize the friendly URL `title` field input to prevent SQL injection (e.g., ensure the `title` field is not used to construct SQL queries without proper parameterization) until the Liferay fix pack/update is applied.
Event History
Frequently Asked Questions
What is CVE-2022-42122?
CVE-2022-42122 is a SQL injection vulnerability in the Friendly Url module in Liferay Portal 7.3.7 and Liferay DXP 7.3.
How severe is CVE-2022-42122?
CVE-2022-42122 has a severity rating of 9.8 (Critical).
What is the affected software?
The affected software includes Liferay Portal 7.3.7 and Liferay DXP 7.3 fix pack 2 through update 4.
How can attackers exploit CVE-2022-42122?
Attackers can exploit CVE-2022-42122 by executing arbitrary SQL commands via a crafted payload injected into the `title` field of a friendly URL.
Are there any known fixes for CVE-2022-42122?
Yes, you can find more information about fixes for CVE-2022-42122 on the official Liferay website and the Liferay security page.