CVE-2022-42112
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
A Cross-site scripting (XSS) vulnerability in the Portal Search module's Sort widget in Liferay Portal 7.2.0 through 7.4.3.24, and Liferay DXP 7.2 before fix pack 19, 7.3 before update 5, and DXP 7.4 before update 25 allows remote attackers to inject arbitrary web script or HTML via a crafted payload.
Risk Assessment
Risk of user session theft, administrator account takeover, or distribution of malicious code within the organization by exploiting the XSS vulnerability in the corporate portal.
Recommendation
Immediately update Liferay Portal to version 7.4.3.25 or later, and for DXP apply the appropriate fix pack or update (DXP 7.2 fix pack 19, DXP 7.3 update 5, DXP 7.4 update 25).
Original NVD description (English source)
A Cross-site scripting (XSS) vulnerability in the Portal Search module's Sort widget in Liferay Portal 7.2.0 through 7.4.3.24, and Liferay DXP 7.2 before fix pack 19, 7.3 before update 5, and DXP 7.4 before update 25 allows remote attackers to inject arbitrary web script or HTML via a crafted payload.