CVE-2022-42113: XSS Vulnerability in Liferay Document Library Module
Summary
CVE-2022-42113: Liferay Portal and Liferay DXP Vulnerable to XSS via the Document Library Module. Affects com.liferay:com.liferay.document.library.web versions < 6.0.98. Fixed in 6.0.98. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Liferay Document Library module is a key component of the Liferay Portal, which is a popular open-source platform for building web applications and managing content. This module allows users to upload, manage, and share documents within the portal. It is widely used in enterprise environments for its robust features and flexibility. However, a recent vulnerability has been identified that exposes users to potential cross-site scripting (XSS) attacks, compromising the security of the application.
Vulnerability Detail
A Cross-site scripting (XSS) vulnerability exists in the Document Library module of Liferay Portal versions prior to 6.0.98 and Liferay DXP versions 7.4.3.30 through 7.4.3.36. This vulnerability allows remote attackers to inject arbitrary web scripts or HTML via the 'redirect' parameter, which can lead to unauthorized actions being performed on behalf of the user or the exposure of sensitive information.
How To Fix
Minimum fixed version
6.0.98
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not possible, consider implementing input validation and sanitization for the 'redirect' parameter to mitigate the risk of XSS attacks. This can be done by encoding user inputs and ensuring that only safe URLs are processed.
Conclusion
The XSS vulnerability identified in the Liferay Document Library module poses a significant risk to users and applications utilizing this component. It is crucial to apply the necessary updates to mitigate the threat and ensure the security of your web applications.
See every vulnerability recorded for com.liferay:com.liferay.document.library.web →
FAQ
CVE-2022-42113 is a vulnerability in the Liferay Document Library module that allows for cross-site scripting (XSS) attacks.
The vulnerability affects Liferay Portal versions prior to 6.0.98 and Liferay DXP versions 7.4.3.30 through 7.4.3.36.
You can use Vulert, which monitors open-source vulnerabilities in your software by analyzing the pom.xml file. Visit Vulert Scanner to check your application without needing to sign up.
Exploitation of this vulnerability can lead to unauthorized actions on behalf of users, data theft, or the injection of malicious scripts.
The CVSS score for this vulnerability is 6.1, indicating a moderate level of risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.liferay:com.liferay.document.library.web.
