Description

A Cross-site scripting (XSS) vulnerability in the Portal Search module in Liferay Portal 7.1.0 through 7.4.2, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 15, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the `tag` parameter.

Remediation

References

CVE-2022-42118

Related Vulnerabilities

Oracle Application Server CVE-2007-5516 Vulnerability (CVE-2007-5516)

ZenCart Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2008-6986)

WordPress Plugin ARMember-Content Restriction & Membership Security Bypass (1.4)

Magento Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2019-8109)

Ruby on Rails Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-8264)

Severity

Medium

Classification

CVE-2022-42118 CWE-707 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities