CVE-2022-42115

MediumCVSS 5.4

Published: 18/10/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.48%

38th percentile - higher than 38% of all known CVEs

Summary

Cross-site scripting (XSS) vulnerability in the Object module of Liferay Portal 7.4.3.4 through 7.4.3.36. Remote attackers can inject arbitrary web script or HTML via the `Label` text field on the edit object details page.

Risk Assessment

An attacker could steal user sessions, redirect users to malicious sites, or perform other harmful actions within the victim's browser context.

Recommendation

Immediately upgrade Liferay Portal to version 7.4.3.37 or later, which includes a fix for this vulnerability.

Original NVD description (English source)

Cross-site scripting (XSS) vulnerability in the Object module's edit object details page in Liferay Portal 7.4.3.4 through 7.4.3.36 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into the object field's `Label` text field.