CVE-2022-42117

MEDIUM

Liferay DXP < 7.3 and 7.3.2-7.4.3.16 - Cross-Site Scripting in Frontend Taglib Module

Title source: llm
STIX 2.1

Description

A Cross-site scripting (XSS) vulnerability in the Frontend Taglib module in Liferay Portal 7.3.2 through 7.4.3.16, and Liferay DXP 7.3 before update 6, and 7.4 before update 17 allows remote attackers to inject arbitrary web script or HTML.

References (2)

Core 2

Scores

CVSS v3 6.1
EPSS 0.0012
EPSS Percentile 30.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (6)
com.liferay/com.liferay.frontend.taglib.clay 0 - 9.1.7Maven
com.liferay.portal/release.dxp.bom 7.3.0 - 7.3.10.u6Maven
liferay/dxp 7.3 (10 CPE variants)
liferay/dxp 7.4 ga1 (17 CPE variants)
liferay/dxp < 7.3
liferay/liferay_portal 7.3.2 - 7.4.3.16
Published Oct 18, 2022
Tracked Since Feb 18, 2026