CVE-2022-42118: Liferay Portal and Liferay DXP Vulnerable to XSS via the Portal Search Module
Summary
CVE-2022-42118: Liferay Portal and Liferay DXP Vulnerable to XSS via the Portal Search Module. Affects com.liferay:com.liferay.portal.search.web versions < 6.0.12. Fixed in 6.0.12. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Liferay Portal is a popular open-source platform used for building web applications and managing content. It provides a robust framework for developing enterprise-level applications with features like user management, content management, and search capabilities. The Portal Search module is integral to its functionality, allowing users to search for content across the platform. However, this module has been found to be vulnerable to a Cross-site scripting (XSS) attack, which can allow attackers to inject malicious scripts into web pages viewed by other users.
Vulnerability Detail
The vulnerability, identified as CVE-2022-42118, originates from improper handling of the 'tag' parameter in the Portal Search module. This flaw allows remote attackers to inject arbitrary web scripts or HTML into the application, potentially leading to unauthorized actions being performed on behalf of users or the exposure of sensitive information. The affected versions include Liferay Portal versions prior to 6.0.12 and Liferay DXP versions 7.1.0 through 7.4.2, with specific fix packs addressing the issue.
How To Fix
Minimum fixed version
6.0.12
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider implementing input validation and sanitization for the 'tag' parameter to mitigate the risk of XSS attacks. This can be done by escaping user inputs before processing them in the application.
Conclusion
CVE-2022-42118 represents a significant security risk for users of Liferay Portal and Liferay DXP due to its XSS vulnerability. It is crucial for users to update their systems to the patched versions to mitigate this risk and ensure the security of their applications.
See every vulnerability recorded for com.liferay:com.liferay.portal.search.web →
FAQ
CVE-2022-42118 is a vulnerability in the Liferay Portal and Liferay DXP that allows for Cross-site scripting (XSS) attacks via the Portal Search module.
The vulnerability affects Liferay Portal versions prior to 6.0.12 and Liferay DXP versions 7.1.0 through 7.4.2.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The potential impacts include unauthorized actions performed on behalf of users and exposure of sensitive information due to malicious script injections.
The CVSS score for CVE-2022-42118 is 6.1, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for com.liferay:com.liferay.portal.search.web.
