CVE-2022-42119

Published: Nov 15, 2022Modified: Jul 9, 2026

5.4

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.3 / Impact: 2.7

Source: NVD

Description

Certain Liferay products are vulnerable to Cross Site Scripting (XSS) via the Commerce module. This affects Liferay Portal 7.3.5 through 7.4.2 and Liferay DXP 7.3 before update 8.

Affected (9)

Products: Liferay: Liferay Portal, Dxp

Liferay

2 products

Liferay Portal

Dxp

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Liferay Liferay Portal	From 7.3.5 to 7.4.2

Configuration B

8 vulnerable

Vulnerable Software	Affected Versions
Liferay Dxp	Version 7.3
Liferay Dxp	Version 7.3 update_1
Liferay Dxp	Version 7.3 update_2
Liferay Dxp	Version 7.3 update_3
Liferay Dxp	Version 7.3 update_4
Liferay Dxp	Version 7.3 update_5
Liferay Dxp	Version 7.3 update_6
Liferay Dxp	Version 7.3 update_7