CVE-2022-42118
MediumCVSS 6.1Exploitation Probability (EPSS)
Elevated risk55th percentile - higher than 55% of all known CVEs
Summary
A Cross-site scripting (XSS) vulnerability in the Portal Search module in Liferay Portal 7.1.0 through 7.4.2, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 15, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the `tag` parameter.
Risk Assessment
The risk for the organization includes user session theft, account takeover, data leakage, or spreading malicious code within the portal context.
Recommendation
It is recommended to immediately upgrade Liferay Portal to version 7.4.3 or later, and for Liferay DXP apply the relevant fixes (fix pack 27 for 7.1, fix pack 15 for 7.2, service pack 3 for 7.3).
Original NVD description (English source)
A Cross-site scripting (XSS) vulnerability in the Portal Search module in Liferay Portal 7.1.0 through 7.4.2, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 15, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the `tag` parameter.