VYPR
← All advisories
Medium severity5.4NVD Advisory· Published Nov 15, 2022· Updated Jun 17, 2026

CVE-2022-42111

CVE-2022-42111

Description

A Cross-site scripting (XSS) vulnerability in the Sharing module's user notification in Liferay Portal 7.2.1 through 7.4.2, and Liferay DXP 7.2 before fix pack 19, and 7.3 before update 4 allows remote attackers to inject arbitrary web script or HTML by sharing an asset with a crafted payload.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
com.liferay:com.liferay.sharing.webMaven
< 3.0.93.0.9
com.liferay.portal:release.dxp.bomMaven
>= 7.2.0, < 7.2.10.fp197.2.10.fp19
com.liferay.portal:release.dxp.bomMaven
>= 7.3.0, < 7.3.10.u47.3.10.u4

Affected products

24
  • Liferay/Digital Experience Platform16 versions
    cpe:2.3:a:liferay:digital_experience_platform:7.2:-:*:*:*:*:*:*+ 15 more
    • cpe:2.3:a:liferay:digital_experience_platform:7.2:-:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_10:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_11:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_12:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_13:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_14:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_15:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_1:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_2:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_3:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_4:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_5:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_6:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_7:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_8:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_9:*:*:*:*:*:*
  • Liferay/DXP4 versions
    cpe:2.3:a:liferay:dxp:7.3:-:*:*:*:*:*:*+ 3 more
    • cpe:2.3:a:liferay:dxp:7.3:-:*:*:*:*:*:*
    • cpe:2.3:a:liferay:dxp:7.3:update_1:*:*:*:*:*:*
    • cpe:2.3:a:liferay:dxp:7.3:update_2:*:*:*:*:*:*
    • cpe:2.3:a:liferay:dxp:7.3:update_3:*:*:*:*:*:*
  • Liferay/Portal
    cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*
    Range: >=7.2.1,<=7.4.2
  • Liferay/Sharing module's user notification in Portaldescription
  • ghsa-coords2 versions
    pkg:maven/com.liferay.portal/release.dxp.bompkg:maven/com.liferay/com.liferay.sharing.web
    >= 7.2.0, < 7.2.10.fp19+ 1 more
    • (no CPE)range: >= 7.2.0, < 7.2.10.fp19
    • (no CPE)range: < 3.0.9

Patches

Vulnerability mechanics

References

9

News mentions

0

No linked articles in our index yet.