CVE-2022-42120
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk50th percentile - higher than 50% of all known CVEs
Summary
A SQL injection vulnerability in the Fragment module in Liferay Portal 7.3.3 through 7.4.3.16, and Liferay DXP 7.3 before update 4, and 7.4 before update 17 allows attackers to execute arbitrary SQL commands via a PortletPreferences' `namespace` attribute.
Risk Assessment
The risk includes unauthorized database access, data leakage, and potential system compromise.
Recommendation
Immediately upgrade Liferay Portal to version 7.4.3.17 or later, and Liferay DXP to version 7.3 update 4 or 7.4 update 17.
Original NVD description (English source)
A SQL injection vulnerability in the Fragment module in Liferay Portal 7.3.3 through 7.4.3.16, and Liferay DXP 7.3 before update 4, and 7.4 before update 17 allows attackers to execute arbitrary SQL commands via a PortletPreferences' `namespace` attribute.