CVE-2022-42117
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
A Cross-site scripting (XSS) vulnerability in the Frontend Taglib module in Liferay Portal 7.3.2 through 7.4.3.16, and Liferay DXP 7.3 before update 6, and 7.4 before update 17 allows remote attackers to inject arbitrary web script or HTML.
Risk Assessment
An attacker can steal user session data, redirect users to malicious sites, or perform other unauthorized actions within the user's session, compromising data confidentiality and integrity.
Recommendation
Immediately update Liferay Portal to version 7.4.3.17 or later, and Liferay DXP to version 7.3 update 6 or 7.4 update 17.
Original NVD description (English source)
A Cross-site scripting (XSS) vulnerability in the Frontend Taglib module in Liferay Portal 7.3.2 through 7.4.3.16, and Liferay DXP 7.3 before update 6, and 7.4 before update 17 allows remote attackers to inject arbitrary web script or HTML.