CVE-2022-42131
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
Liferay products are missing SSL certificate validation in the Dynamic Data Mapping module's REST data providers. This affects Liferay Portal 7.1.0 through 7.4.2 and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 17, and 7.3 before service pack 3.
Risk Assessment
An attacker could perform a man-in-the-middle attack, intercepting or modifying data exchanged between the system and external REST data sources, potentially leading to sensitive information disclosure.
Recommendation
Immediately upgrade Liferay Portal to version 7.4.3 or later, and for Liferay DXP apply the appropriate fixes: fix pack 27 for 7.1, fix pack 17 for 7.2, or service pack 3 for 7.3.
Original NVD description (English source)
Certain Liferay products are affected by: Missing SSL Certificate Validation in the Dynamic Data Mapping module's REST data providers. This affects Liferay Portal 7.1.0 through 7.4.2 and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 17, and 7.3 before service pack 3.