CVE-2022-42119

MediumCVSS 5.4

Published: 15/11/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.39%

31th percentile - higher than 31% of all known CVEs

Summary

A Cross Site Scripting (XSS) vulnerability has been discovered in Liferay products via the Commerce module. This affects Liferay Portal versions 7.3.5 through 7.4.2 and Liferay DXP 7.3 before update 8.

Risk Assessment

An attacker can inject malicious JavaScript code, potentially leading to user session theft, account takeover, or sensitive data leakage.

Recommendation

It is recommended to immediately upgrade Liferay Portal to version 7.4.3 or later, and for Liferay DXP 7.3 apply update 8 or later.

Original NVD description (English source)

Certain Liferay products are vulnerable to Cross Site Scripting (XSS) via the Commerce module. This affects Liferay Portal 7.3.5 through 7.4.2 and Liferay DXP 7.3 before update 8.