Description

A SQL injection vulnerability in the Friendly Url module in Liferay Portal 7.3.7, and Liferay DXP 7.3 fix pack 2 through update 4 allows attackers to execute arbitrary SQL commands via a crafted payload injected into the `title` field of a friendly URL.

Remediation

References

CVE-2022-42122

Related Vulnerabilities

Sqlite NULL Pointer Dereference Vulnerability (CVE-2019-19926)

WordPress Plugin Advanced Custom Fields (ACF) Multiple Security Bypass Vulnerabilities (5.10.2)

PHP version older than 5.2.6

Grafana Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2021-43798)

Joomla! Core 3.9.x Cross-Site Scripting (3.9.0 - 3.9.23)

Severity

Critical

Classification

CVE-2022-42122 CWE-138 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities