GHSA-7f7g-vhff-mjqj
Dashboard / Vulnerabilities / GHSA-7f7g-vhff-mjqj
Summary: Liferay Portal and Liferay DXP Vulnerable to XSS via the Portal Search Module
Details: A Cross-site scripting (XSS) vulnerability in the Portal Search module's Sort widget before 6.0.45 from Liferay Portal (7.2.0 through 7.4.3.24), and Liferay DXP 7.2 before fix pack 19, 7.3 before update 5, and DXP 7.4 before update 25 allows remote attackers to inject arbitrary web script or HTML via a crafted payload.
References: https://nvd.nist.gov/vuln/detail/CVE-2022-42112, https://github.com/liferay/liferay-portal/commit/1f6521605152c0f8f82f490300215f08f885fe48, https://github.com/liferay/liferay-portal, https://liferay.atlassian.net/browse/LPE-17536, https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2022-42112?p_r_p_assetEntryId=121612934&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121612934%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse, https://web.archive.org/web/20220701000000*/https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42112, http://liferay.com
Affected packages
Package
Name: com.liferay:com.liferay.portal.search.web
Purl: pkg:maven/com.liferay/com.liferay.portal.search.web
Affected ranges
Type: ECOSYSTEM
Events:
