CVE-2022-28981: Path Traversal Vulnerability in com.liferay.headless.discovery.web Package
Summary
CVE-2022-28981: Liferay Portal Path Traversal Vulnerability via the Hypermedia REST APIs Module. Affects com.liferay:com.liferay.headless.discovery.web versions < 4.0.12. Fixed in 4.0.12. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The com.liferay.headless.discovery.web package is part of the Liferay Portal, which provides a set of APIs for accessing and managing resources in a web environment. This package enables developers to create hypermedia-driven applications, allowing for dynamic interaction with web services. However, it has been identified to have a significant security flaw that could expose sensitive files to unauthorized access.
Vulnerability Detail
The vulnerability arises from a path traversal issue in the Hypermedia REST APIs module of the com.liferay.headless.discovery.web package, affecting versions prior to 4.0.12. Attackers can exploit this flaw by manipulating the 'parameter' parameter to access files outside the intended directory, specifically files located outside of com.liferay.headless.discovery.web/META-INF/resources. This could lead to unauthorized data exposure, potentially compromising sensitive information stored on the server.
How To Fix
Minimum fixed version
4.0.12
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, a temporary workaround is to restrict access to the affected APIs or implement additional validation on the 'parameter' parameter to prevent unauthorized file access. However, this is not a substitute for applying the official patch.
Conclusion
The CVE-2022-28981 vulnerability in the com.liferay.headless.discovery.web package poses a significant risk due to its path traversal nature, allowing unauthorized file access. It is crucial to update to version 4.0.12 or later to mitigate this risk effectively.
See every vulnerability recorded for com.liferay:com.liferay.headless.discovery.web →
FAQ
CVE-2022-28981 is a path traversal vulnerability found in the com.liferay.headless.discovery.web package, allowing unauthorized access to files on the server.
Versions of com.liferay.headless.discovery.web prior to 4.0.12 are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities using just the pom.xml file. Visit Vulert Scanner to check your application without any signup.
Exploitation of this vulnerability could lead to unauthorized access to sensitive files, potentially compromising the security of the application and its data.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
