critical9.8
CVE-2022-42120
Liferay Portal and Liferay DXP Vulnerable to SQL Injection via the Fragment Module
Impact
A SQL injection vulnerability in the Fragment module before 4.0.33 from Liferay Portal (7.3.3 through 7.4.3.16), and Liferay DXP 7.3 before update 4, and 7.4 before update 17 allows attackers to execute arbitrary SQL commands via a PortletPreferences' `namespace` attribute.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | com.liferay:com.liferay.fragment.service | < 4.0.33 | 4.0.33 |
| maven | com.liferay.portal:release.dxp.bom | >= 7.3.0, < 7.3.10.u4 | 7.3.10.u4 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Liferay | Dxp | Versions 7.3, 7.4 |
| Liferay | Liferay Portal | from 7.3.3 through 7.4.3.16 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://issues.liferay.com/browse/LPE-17513
- https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42120
- https://github.com/advisories/GHSA-r5fj-j449-vqw2
- https://nvd.nist.gov/vuln/detail/CVE-2022-42120
- http://liferay.com
- https://github.com/liferay/liferay-portal/commit/6f94d203f5a194a64055e1e0ba0224d26ec54e47
- https://web.archive.org/web/20220801000000*/https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42120