CVE-2022-42116

A Cross-site scripting (XSS) vulnerability in the Frontend Editor module's integration with CKEditor in Liferay Portal 7.3.2 through 7.4.3.14, and Liferay DXP 7.3 before update 6, and 7.4 before update 15 allows remote attackers to inject arbitrary web script or HTML via the (1) name, or (2) namespace parameter.

Link	Resource
https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42116	Patch Vendor Advisory
http://liferay.com	Product

Configuration 1

cpe:2.3:a:liferay:dxp:*:*:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.3:-:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.4:update_1:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.4:update_2:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.4:update_3:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.4:update_4:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.4:update_5:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.4:update_6:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.4:update_7:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.4:update_9:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.4:update_8:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.4:update_10:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.4:update_11:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.4:update_12:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.4:update_14:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.4:update_13:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.3:update_1:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.3:update_2:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.3:update_3:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.3:update_4:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.3:update_5:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.3:sp1:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.3:sp2:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.3:sp3:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.4:ga1:*:*:*:*:*:* cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*

---

Published : 2022-10-18 09:15

Updated : 2022-10-20 06:08

---

NVD link : CVE-2022-42116

Mitre link : CVE-2022-42116

No products.

CWE-79