CVE-2022-42116: Liferay Frontend Editor CKEditor Web Vulnerable to XSS
Summary
CVE-2022-42116: A Cross-site scripting (XSS) vulnerability in the Frontend Editor module's integration with CKEditor in Liferay Frontend Editor CKEditor Web before 5.0.46 from Liferay Portal (7.3.2 through 7.4.3.14), and Liferay DXP 7.3... Affects com.liferay:com.liferay.frontend.editor.ckeditor.web versions < 5.0.46. Fixed in 5.0.46. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Liferay Frontend Editor CKEditor Web is a component of the Liferay Portal that integrates CKEditor, a popular rich text editor, allowing users to create and edit content easily. This package is widely used in Liferay applications to enhance user experience with rich text editing capabilities. However, it has been found to be vulnerable to a Cross-site Scripting (XSS) attack, which can compromise the security of applications using this package.
Vulnerability Detail
A Cross-site scripting (XSS) vulnerability exists in the integration of the Frontend Editor module with CKEditor in Liferay Frontend Editor CKEditor Web versions prior to 5.0.46. This vulnerability affects Liferay Portal versions 7.3.2 through 7.4.3.14, and Liferay DXP 7.3 before update 6, and 7.4 before update 15. Attackers can exploit this vulnerability by injecting arbitrary web scripts or HTML via the 'name' or 'namespace' parameters, potentially leading to unauthorized actions or data exposure.
How To Fix
Minimum fixed version
5.0.46
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider implementing input validation and sanitization for the 'name' and 'namespace' parameters to mitigate the risk of XSS attacks. This can be done by escaping user inputs before processing them in the application.
Conclusion
The XSS vulnerability in Liferay Frontend Editor CKEditor Web poses a significant risk to applications using this component. It is crucial to update to the patched versions to safeguard against potential attacks. Implementing input validation can serve as a temporary workaround while updates are applied.
See every vulnerability recorded for com.liferay:com.liferay.frontend.editor.ckeditor.web →
FAQ
CVE-2022-42116 is a vulnerability in the Liferay Frontend Editor CKEditor Web that allows for Cross-site Scripting (XSS) attacks.
The vulnerability affects Liferay Frontend Editor CKEditor Web versions prior to 5.0.46, Liferay Portal versions 7.3.2 through 7.4.3.14, and Liferay DXP 7.3 before update 6, and 7.4 before update 15.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground without any signup.
Exploitation of this vulnerability can lead to unauthorized actions, data exposure, and compromise of user sessions through XSS attacks.
The CVSS score for this vulnerability is 6.1, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for com.liferay:com.liferay.frontend.editor.ckeditor.web.
