Description

A SQL injection vulnerability in the Layout module in Liferay Portal 7.1.3 through 7.4.3.4, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 17, 7.3 before service pack 3, and 7.4 GA allows remote authenticated attackers to execute arbitrary SQL commands via a crafted payload injected into a page template's 'Name' field.

Remediation

References

CVE-2022-42121

Related Vulnerabilities

WordPress Plugin Breezing Forms Cross-Site Scripting (1.2.7.33)

MyBB Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2021-43281)

Jboss EAP Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') Vulnerability (CVE-2019-3805)

WordPress Plugin Jetpack-WP Security, Backup, Speed, & Growth Cross-Site Scripting (6.4.2)

WordPress Plugin Global Flash Galleries Cross-Site Scripting (0.13.4)

Severity

High

Classification

CVE-2022-42121 CWE-138 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities