CVE-2022-42116
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
A Cross-site scripting (XSS) vulnerability in the Frontend Editor module's integration with CKEditor in Liferay Portal 7.3.2 through 7.4.3.14, and Liferay DXP 7.3 before update 6, and 7.4 before update 15 allows remote attackers to inject arbitrary web script or HTML via the name or namespace parameter.
Risk Assessment
The risk includes potential session hijacking, redirection to malicious sites, or content manipulation within the application context, leading to confidentiality and integrity breaches.
Recommendation
Immediately update Liferay Portal to version 7.4.3.15 or later, and for Liferay DXP apply the respective updates (update 6 for version 7.3, update 15 for version 7.4).
Original NVD description (English source)
A Cross-site scripting (XSS) vulnerability in the Frontend Editor module's integration with CKEditor in Liferay Portal 7.3.2 through 7.4.3.14, and Liferay DXP 7.3 before update 6, and 7.4 before update 15 allows remote attackers to inject arbitrary web script or HTML via the (1) name, or (2) namespace parameter.