CVE-2022-42114

MediumCVSS 5.4

Published: 18/10/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.48%

38th percentile - higher than 38% of all known CVEs

Summary

A cross-site scripting (XSS) vulnerability in the Role module's edit role assignees page in Liferay Portal and DXP allows remote attackers to inject arbitrary web script or HTML.

Risk Assessment

An attacker could steal user sessions, redirect users to malicious sites, or perform other actions in the victim's browser context, compromising data confidentiality and integrity.

Recommendation

Immediately upgrade Liferay Portal to version 7.4.3.37 or later, and Liferay DXP 7.4 to update 37 or later.

Original NVD description (English source)

A Cross-site scripting (XSS) vulnerability in the Role module's edit role assignees page in Liferay Portal 7.4.0 through 7.4.3.36, and Liferay DXP 7.4 before update 37 allows remote attackers to inject arbitrary web script or HTML.