CVE-2022-42122
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk49th percentile - higher than 49% of all known CVEs
Summary
A SQL injection vulnerability in the Friendly Url module in Liferay Portal 7.3.7 and Liferay DXP 7.3 fix pack 2 through update 4 allows attackers to execute arbitrary SQL commands via a crafted payload injected into the `title` field of a friendly URL.
Risk Assessment
The risk for the organization includes unauthorized database access, sensitive data leakage, and potential system takeover.
Recommendation
It is recommended to immediately upgrade Liferay Portal to version 7.3.8 or later and Liferay DXP to version 7.3 update 5 or later, and apply the relevant security patches.
Original NVD description (English source)
A SQL injection vulnerability in the Friendly Url module in Liferay Portal 7.3.7, and Liferay DXP 7.3 fix pack 2 through update 4 allows attackers to execute arbitrary SQL commands via a crafted payload injected into the `title` field of a friendly URL.