Description

A Cross-site scripting (XSS) vulnerability in the Frontend Editor module's integration with CKEditor in Liferay Portal 7.3.2 through 7.4.3.14, and Liferay DXP 7.3 before update 6, and 7.4 before update 15 allows remote attackers to inject arbitrary web script or HTML via the (1) name, or (2) namespace parameter.

Remediation

References

CVE-2022-42116

Related Vulnerabilities

WordPress Plugin Advanced Custom Fields PRO Cross-Site Scripting (5.9.0)

MySQL CVE-2024-21165 Vulnerability (CVE-2024-21165)

Oracle Database Server CVE-2012-1746 Vulnerability (CVE-2012-1746)

WordPress Plugin WP Quick Booking Manager Cross-Site Scripting (1.1)

WordPress Plugin Easy Digital Downloads-Simple eCommerce for Selling Digital Files Information Disclosure (2.7.6)

Severity

Medium

Classification

CVE-2022-42116 CWE-707 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities