Moole Vulnerability Database

Find real vulnerabilities before they ship

Medium

CVE-2022-42119

Certain Liferay products are vulnerable to Cross Site Scripting (XSS) via the Commerce module. This affects Liferay Portal 7.3.5 through 7.4.2 and Liferay DXP 7.3 before update 8.

VectorNETWORK

PublishedNov 15, 2022, 01:15

Published Bycve@mitre.org

Base Score

Score5.4

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

com.liferay.commerce:com.liferay.commerce.catalog.web(Maven)04.0.8N/A

com.liferay.portal:release.dxp.bom(Maven)7.3.07.3.10.u8N/A

References

http://liferay.com
https://issues.liferay.com/browse/LPE-17632
https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42119

Weakness Type

CWE-79

CVSS Metrics

Base Score

5.4

Vector String

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Base SeverityMedium

Version

3.1

Attack Vector (AV)

NETWORK