CVE-2022-42110: XSS Vulnerability in Liferay Announcements Module
Summary
CVE-2022-42110: Liferay Portal and Liferay DXP Vulnerable to XSS via the Announcements Module. Affects com.liferay:com.liferay.announcements.web versions < 6.0.11. Fixed in 6.0.11. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Liferay Announcements module is a component of the Liferay Portal, which is a popular open-source platform for building web applications and managing content. This module allows users to create and manage announcements that can be displayed on the portal. However, it has been found to be vulnerable to a Cross-site Scripting (XSS) attack, which can allow attackers to inject malicious scripts into web pages viewed by other users.
Vulnerability Detail
A Cross-site scripting (XSS) vulnerability exists in the Announcements module of Liferay Portal versions 7.1.0 through 7.4.2 and Liferay DXP versions 7.1 before fix pack 27, 7.2 before fix pack 17, and 7.3 before service pack 3. This vulnerability allows remote attackers to inject arbitrary web scripts or HTML into the application, potentially leading to unauthorized actions being performed on behalf of users, data theft, or other malicious activities.
How To Fix
Minimum fixed version
6.0.11
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not possible, consider implementing input validation and sanitization on user inputs to mitigate the risk of XSS attacks. This can include encoding output and using libraries that help prevent XSS.
Conclusion
The XSS vulnerability in the Liferay Announcements module poses a significant risk to users of affected versions. It is crucial to apply the necessary updates to mitigate this risk and ensure the security of your applications.
See every vulnerability recorded for com.liferay:com.liferay.announcements.web →
FAQ
CVE-2022-42110 is a vulnerability identifier for a Cross-site scripting (XSS) vulnerability found in the Liferay Announcements module.
The vulnerability affects Liferay Portal versions 7.1.0 through 7.4.2 and Liferay DXP versions 7.1 before fix pack 27, 7.2 before fix pack 17, and 7.3 before service pack 3.
Attackers can exploit this vulnerability to inject malicious scripts, which may lead to unauthorized actions, data theft, or other malicious activities affecting users.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application against this vulnerability using the Vulert playground at Vulert Scanner without any signup.
The CVSS score of this vulnerability is 6.1, indicating a moderate severity level.
