A Cross-site scripting (XSS) vulnerability in the Role module's edit role assignees page in Liferay Portal 7.4.0 through 7.4.3.36, and Liferay DXP 7.4 before update 37 allows remote attackers to inject arbitrary web script or HTML.
References
| Link | Resource |
|---|---|
| http://liferay.com | Product |
| https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42114 | Patch Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
20 Oct 2022, 18:09
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42114 - Patch, Vendor Advisory | |
| References | (MISC) http://liferay.com - Product | |
| First Time |
Liferay dxp
Liferay liferay Portal Liferay |
|
| CWE | CWE-79 | |
| CPE | cpe:2.3:a:liferay:dxp:*:*:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.4:update_32:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.4:update_8:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.4:update_24:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.4:update_29:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.4:update_12:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.4:update_20:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.4:update_18:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.4:update_36:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.4:update_5:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.4:update_21:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.4:update_2:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.4:update_10:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.4:update_15:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.4:update_16:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.4:update_31:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.4:update_9:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.4:update_25:*:*:*:*:*:* cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.4:update_4:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.4:update_14:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.4:update_28:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.4:update_6:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.4:update_26:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.4:update_30:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.4:update_34:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.4:update_7:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.4:update_23:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.4:update_1:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.4:update_33:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.4:update_17:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.4:update_3:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.4:update_35:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.4:ga1:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.4:update_22:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.4:update_19:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.4:update_13:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.4:update_11:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.4:update_27:*:*:*:*:*:* |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.4 |
18 Oct 2022, 21:18
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-10-18 21:15
Updated : 2023-12-10 14:35
NVD link : CVE-2022-42114
Mitre link : CVE-2022-42114
CVE.ORG link : CVE-2022-42114
JSON object : View
Products Affected
liferay
- dxp
- liferay_portal
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')