Description

A Cross-site scripting (XSS) vulnerability in the Portal Search module in Liferay Portal 7.1.0 through 7.4.2, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 15, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the `tag` parameter.

Remediation

References

CVE-2022-42118

Related Vulnerabilities

WordPress Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2011-0700)

WordPress Plugin FunCaptcha-Anti-Spam CAPTCHA Cross-Site Request Forgery (0.3.2)

Moodle Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2015-5335)

WordPress Plugin Attachment File Icons (AF Icons) Cross-Site Request Forgery (1.3)

WordPress Plugin Relevanssi-A Better Search SQL Injection (3.6.0)

Severity

Medium

Classification

CVE-2022-42118 CWE-707 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities