CVE-2022-28979
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
Liferay Portal versions 7.1.0 through 7.4.2 and Liferay DXP 7.1 before fix pack 26, 7.2 before fix pack 15, and 7.3 before service pack 3 contain a cross-site scripting (XSS) vulnerability in the Custom Facet widget of the Portal Search module. Attackers can inject arbitrary JavaScript or HTML via the Custom Parameter Name text field.
Risk Assessment
The risk involves the execution of arbitrary scripts in the victim's browser, potentially leading to session hijacking, account takeover, or sensitive data leakage within the organization.
Recommendation
Immediately update Liferay Portal to version 7.4.3 or later, and for Liferay DXP apply the relevant fixes: fix pack 26 for 7.1, fix pack 15 for 7.2, or service pack 3 for 7.3.
Other vulnerabilities in Liferay Portal
See all- CVE-2010-5327High
Liferay Portal through 6.2.10 allows remote authenticated users to execute arbitrary shell commands via a crafted Velocity template.
- CVE-2022-42122Critical
A SQL injection vulnerability in the Friendly Url module in Liferay Portal 7.3.7 and Liferay DXP 7.3 fix pack 2 through update 4 allows attackers to execute arbitrary SQL commands via a crafted payload injected into the `title` field of a friendly URL.
- CVE-2022-42120Critical
A SQL injection vulnerability in the Fragment module in Liferay Portal 7.3.3 through 7.4.3.16, and Liferay DXP 7.3 before update 4, and 7.4 before update 17 allows attackers to execute arbitrary SQL commands via a PortletPreferences' `namespace` attribute.
- CVE-2020-7961CriticalActively exploited
Deserialization of untrusted data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web services (JSONWS).
- CVE-2022-42132Medium
In Liferay Portal and DXP, the Test LDAP Users functionality exposes LDAP credentials in the page URL when paginating through the user list. Man-in-the-middle attackers or those with access to request logs can capture these credentials.
- CVE-2022-42131Medium
Liferay products are missing SSL certificate validation in the Dynamic Data Mapping module's REST data providers. This affects Liferay Portal 7.1.0 through 7.4.2 and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 17, and 7.3 before service pack 3.
- CVE-2022-42130Medium
The Dynamic Data Mapping module in Liferay Portal 7.1.0 through 7.4.3.4, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 19, 7.3 before update 4, and 7.4 GA does not properly check permission of form entries, which allows remote authenticated users to view and access all form entries.
- CVE-2022-42129Medium
An IDOR vulnerability in the Dynamic Data Mapping module in Liferay Portal 7.3.2 through 7.4.3.4, and Liferay DXP 7.3 before update 4, and 7.4 GA allows remote authenticated users to view and access form entries via the `formInstanceRecordId` parameter.
- CVE-2022-42128Medium
The Hypermedia REST APIs module in Liferay Portal 7.4.1 through 7.4.3.4 and Liferay DXP 7.4 GA does not properly check permissions, allowing remote attackers to obtain a WikiNode object via the WikiNodeResource.getSiteWikiNodeByExternalReferenceCode API.
- CVE-2022-42127Medium
The Friendly Url module in Liferay Portal 7.4.3.5 through 7.4.3.36 and Liferay DXP 7.4 update 1 through 36 does not properly check user permissions, allowing remote attackers to obtain the history of all friendly URLs assigned to a page.
Original NVD description (English source)
Liferay Portal v7.1.0 through v7.4.2 and Liferay DXP 7.1 before fix pack 26, 7.2 before fix pack 15, and 7.3 before service pack 3 was discovered to contain a cross-site scripting (XSS) vulnerability in the Portal Search module's Custom Facet widget. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Custom Parameter Name text field.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS