CVE-2022-42117: XSS Vulnerability in Liferay Portal's Frontend Taglib Module
Summary
CVE-2022-42117: Liferay Portal and Liferay DXP Vulnerable to XSS in the Frontend Taglib Module. Affects com.liferay:com.liferay.frontend.taglib.clay versions < 9.1.7. Fixed in 9.1.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Liferay Portal is a popular open-source platform for building web applications and managing content. The Frontend Taglib module is a crucial component that provides reusable UI elements and functionalities for developers. However, this module has been found to be vulnerable to a Cross-site Scripting (XSS) attack, which can allow malicious users to inject arbitrary scripts or HTML into web pages, potentially compromising user data and application integrity.
Vulnerability Detail
The vulnerability arises from improper handling of user input in the Frontend Taglib module prior to version 9.1.7. This flaw allows attackers to exploit the system by injecting malicious scripts that execute in the context of the user's browser. The affected versions include Liferay Portal 7.3.2 through 7.4.3.16 and Liferay DXP 7.3 before update 6, and 7.4 before update 17. The ramifications of this vulnerability can lead to unauthorized access to sensitive information, session hijacking, and defacement of web content.
How To Fix
Latest published version: 16.0.2 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
9.1.7
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider implementing input validation and sanitization measures to mitigate the risk of XSS attacks. Ensure that user inputs are properly encoded before being rendered in the browser.
Conclusion
The XSS vulnerability in Liferay Portal's Frontend Taglib module poses significant risks to web applications. It is crucial for users to update their systems to the latest patched versions to mitigate these risks and ensure the security of their applications.
See every vulnerability recorded for com.liferay:com.liferay.frontend.taglib.clay →
FAQ
CVE-2022-42117 is a vulnerability in the Frontend Taglib module of Liferay Portal that allows for Cross-site Scripting (XSS) attacks.
Affected versions include Liferay Portal 7.3.2 through 7.4.3.16 and Liferay DXP 7.3 before update 6, and 7.4 before update 17.
The vulnerability can lead to unauthorized access to sensitive information, session hijacking, and defacement of web content.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software by analyzing your pom.xml file. You can also use the Vulert playground to check for vulnerabilities without signup.
The CVSS score for this vulnerability is 6.1, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for com.liferay:com.liferay.frontend.taglib.clay.
