CVE-2022-42124
First published: Tue Nov 15 2022(Updated: )
ReDoS vulnerability in LayoutPageTemplateEntryUpgradeProcess in Liferay Portal 7.3.2 through 7.4.3.4 and Liferay DXP 7.2 fix pack 9 through fix pack 18, 7.3 before update 4, and DXP 7.4 GA allows remote attackers to consume an excessive amount of server resources via a crafted payload injected into the 'name' field of a layout prototype.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Liferay Digital Experience Platform | =7.2-fix_pack_10 | |
| Liferay Digital Experience Platform | =7.2-fix_pack_11 | |
| Liferay Digital Experience Platform | =7.2-fix_pack_12 | |
| Liferay Digital Experience Platform | =7.2-fix_pack_13 | |
| Liferay Digital Experience Platform | =7.2-fix_pack_14 | |
| Liferay Digital Experience Platform | =7.2-fix_pack_15 | |
| Liferay Digital Experience Platform | =7.2-fix_pack_16 | |
| Liferay Digital Experience Platform | =7.2-fix_pack_9 | |
| Liferay Digital Experience Platform | =7.3 | |
| Liferay Digital Experience Platform | =7.4 | |
| Liferay Liferay Portal | >=7.3.2<7.4.3.5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2022-42124
- https://issues.liferay.com/browse/LPE-17435
- https://issues.liferay.com/browse/LPE-17535
- https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42124
- https://github.com/advisories/GHSA-vjj4-qwcm-552h (Advisory)
- http://liferay.com
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2022-42124.
What is the severity of CVE-2022-42124?
The severity of CVE-2022-42124 is high with a severity value of 7.5.
Which software versions are affected by CVE-2022-42124?
CVE-2022-42124 affects Liferay Portal versions 7.3.2 through 7.4.3.4 and Liferay DXP versions 7.2 fix pack 9 through fix pack 18, 7.3 before update 4, and DXP 7.4 GA.
How can a remote attacker exploit CVE-2022-42124?
A remote attacker can exploit CVE-2022-42124 by injecting a crafted payload into Liferay Portal, consuming an excessive amount of server resources.
How can I fix CVE-2022-42124?
To fix CVE-2022-42124, update to Liferay Portal version 7.4.3.5 or higher.
- collector/github-advisory-latest
- alias/GHSA-vjj4-qwcm-552h
- alias/CVE-2022-42124
- collector/github-advisory
- collector/nvd-index
- collector/nvd-cve
- agent/author
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- agent/weakness
- agent/tags
- agent/references
- agent/first-publish-date
- agent/event
- agent/description
- agent/trending
- package-manager/maven
- vendor/liferay
- canonical/liferay digital experience platform
- version/liferay digital experience platform/7.2-fix_pack_10
- version/liferay digital experience platform/7.2-fix_pack_11
- version/liferay digital experience platform/7.2-fix_pack_12
- version/liferay digital experience platform/7.2-fix_pack_13
- version/liferay digital experience platform/7.2-fix_pack_14
- version/liferay digital experience platform/7.2-fix_pack_15
- version/liferay digital experience platform/7.2-fix_pack_16
- version/liferay digital experience platform/7.2-fix_pack_9
- version/liferay digital experience platform/7.3
- version/liferay digital experience platform/7.4
- canonical/liferay liferay portal
- version/liferay liferay portal/7.3.2