CVE-2022-42112: Liferay Portal and DXP Vulnerable to XSS via Portal Search Module
Summary
CVE-2022-42112: Liferay Portal and Liferay DXP Vulnerable to XSS via the Portal Search Module. Affects com.liferay:com.liferay.portal.search.web versions < 6.0.45. Fixed in 6.0.45. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Liferay Portal is a popular open-source platform for building web applications and managing content. It provides a robust framework for developing enterprise-level applications with features such as user management, content management, and collaboration tools. The Portal Search module is a critical component that allows users to search for content within the portal. However, it has been found to be vulnerable to a Cross-site Scripting (XSS) attack, which can compromise the security of the application.
Vulnerability Detail
A Cross-site scripting (XSS) vulnerability exists in the Portal Search module's Sort widget, affecting Liferay Portal versions prior to 6.0.45 and Liferay DXP versions 7.2.0 through 7.4.3.24. This vulnerability allows remote attackers to inject arbitrary web scripts or HTML through crafted payloads. The potential ramifications include unauthorized access to sensitive information, session hijacking, and defacement of web pages, posing a significant risk to users and the integrity of the application.
How To Fix
Minimum fixed version
6.0.45
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that user input is properly sanitized and validated before processing it in the Portal Search module. Implementing Content Security Policy (CSP) headers can also help mitigate the risk of XSS attacks.
Conclusion
The CVE-2022-42112 vulnerability poses a significant risk to users of Liferay Portal and DXP due to its potential for XSS attacks. It is crucial to update to the patched versions to mitigate this risk and ensure the security of your applications.
See every vulnerability recorded for com.liferay:com.liferay.portal.search.web →
FAQ
CVE-2022-42112 is a vulnerability in the Liferay Portal and DXP that allows for Cross-site Scripting (XSS) attacks via the Portal Search module.
The vulnerability affects Liferay Portal versions prior to 6.0.45 and Liferay DXP versions 7.2.0 through 7.4.3.24.
Attackers can inject arbitrary web scripts or HTML, potentially leading to unauthorized access, session hijacking, and defacement of web pages.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
The CVSS score for this vulnerability is 5.4, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for com.liferay:com.liferay.portal.search.web.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
