Description

A Cross-site scripting (XSS) vulnerability in the Sharing module's user notification in Liferay Portal 7.2.1 through 7.4.2, and Liferay DXP 7.2 before fix pack 19, and 7.3 before update 4 allows remote attackers to inject arbitrary web script or HTML by sharing an asset with a crafted payload.

Remediation

References

CVE-2022-42111

Related Vulnerabilities

WordPress Plugin wpDataTables-WordPress Data Table, Dynamic Tables & Table Charts (Premium) Multiple Vulnerabilities (3.4.1)

Moodle Improper Input Validation Vulnerability (CVE-2012-6087)

Oracle Database Server CVE-2011-0882 Vulnerability (CVE-2011-0882)

WordPress Plugin BuddyPress Multiple SQL Injection Vulnerabilities (1.7.1)

WordPress Plugin Media Library Categories Multiple Cross-Site Scripting Vulnerabilities (1.1.1)

Severity

Medium

Classification

CVE-2022-42111 CWE-707 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities