CVE-2022-42110

MEDIUM

Liferay Portal 7.1.0-7.4.2 and DXP - Cross-Site Scripting in Announcements Module

Title source: llm
STIX 2.1

Description

A Cross-site scripting (XSS) vulnerability in the Announcements module in Liferay Portal 7.1.0 through 7.4.2, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 17, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML.

References (2)

Core 2

Scores

CVSS v3 6.1
EPSS 0.0047
EPSS Percentile 65.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (6)
com.liferay/com.liferay.announcements.web 0 - 6.0.11Maven
com.liferay.portal/release.dxp.bom 7.1.0 - 7.1.10.fp27Maven
liferay/digital_experience_platform 7.1 (26 CPE variants)
liferay/digital_experience_platform 7.2 (16 CPE variants)
liferay/dxp 7.3 (3 CPE variants)
liferay/liferay_portal 7.1.0 - 7.4.2
Published Nov 15, 2022
Tracked Since Feb 18, 2026