CVE-2022-42113
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
A Cross-site scripting (XSS) vulnerability in the Document Library module in Liferay Portal 7.4.3.30 through 7.4.3.36, and Liferay DXP 7.4 update 30 through 36. Remote attackers can inject arbitrary web script or HTML via the `redirect` parameter.
Risk Assessment
Risk of user session theft, redirection to malicious sites, or unauthorized actions performed in the victim's context.
Recommendation
Immediately upgrade Liferay Portal to version 7.4.3.37 or later, and Liferay DXP to version 7.4 update 37 or later.
Original NVD description (English source)
A Cross-site scripting (XSS) vulnerability in Document Library module in Liferay Portal 7.4.3.30 through 7.4.3.36, and Liferay DXP 7.4 update 30 through update 36 allows remote attackers to inject arbitrary web script or HTML via the `redirect` parameter.