CVE Vulnerability

CVE-2022-42125

Zip slip vulnerability in FileUtil.unzip in Liferay Portal 7.4.3.5 through 7.4.3.35 and Liferay DXP 7.4 update 1 through update 34 allows attackers to create or overwrite existing files on the filesystem via the deployment of a malicious plugin/module.

7.5 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42125 Vendor Advisory
http://liferay.com Vendor Advisory
https://issues.liferay.com/browse/LPE-17517 Vendor Advisory
Configurations

Configuration 1

cpe:2.3:a:liferay:digital_experience_platform:7.4:update34:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update1:*:*:*:*:*:*
cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*
Information

Published : 2022-11-15 01:15

Updated : 2022-11-18 04:51

NVD link : CVE-2022-42125

Mitre link : CVE-2022-42125

Products Affected
No products.
CWE
CWE-22