CVE-2022-42125: Path Traversal
Zip slip vulnerability in FileUtil.unzip in Liferay Portal 7.4.3.5 through 7.4.3.35 and Liferay DXP 7.4 update 1 through update 34 allows attackers to create or overwrite existing files on the filesystem via the deployment of a malicious plugin/module.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2022-42125.
What is the severity of CVE-2022-42125?
The severity of CVE-2022-42125 is high with a CVSS score of 7.5.
Which versions of Liferay Portal and Liferay DXP are affected by CVE-2022-42125?
Liferay Portal versions 7.4.3.5 through 7.4.3.35 and Liferay DXP versions 7.4 update 1 through update 34 are affected by CVE-2022-42125.
How does CVE-2022-42125 work?
CVE-2022-42125 allows attackers to create or overwrite existing files on the filesystem by deploying a malicious plugin/module using the unzip function in Liferay Portal and Liferay DXP.
Is there a fix available for CVE-2022-42125?
Yes, a fix is available for CVE-2022-42125. It is recommended to update to a version of Liferay Portal or Liferay DXP that is not affected by this vulnerability.