CVE-2022-42119

Summary

CVE	CVE-2022-42119
State	PUBLIC
Assigner	[email protected]
Source Priority	CVE Program / NVD first with legacy fallback
Published	2022-11-15 01:15:00 UTC
Updated	2022-11-17 14:48:00 UTC
Description	Certain Liferay products are vulnerable to Cross Site Scripting (XSS) via the Commerce module. This affects Liferay Portal 7.3.5 through 7.4.2 and Liferay DXP 7.3 before update 8.

Risk And Classification

Problem Types: CWE-79

NVD Known Affected Configurations (CPE 2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Application	Liferay	Dxp	7.3	-	All	All
Application	Liferay	Dxp	7.3	update_1	All	All
Application	Liferay	Dxp	7.3	update_2	All	All
Application	Liferay	Dxp	7.3	update_3	All	All
Application	Liferay	Dxp	7.3	update_4	All	All
Application	Liferay	Dxp	7.3	update_5	All	All
Application	Liferay	Dxp	7.3	update_6	All	All
Application	Liferay	Dxp	7.3	update_7	All	All
Application	Liferay	Liferay Portal	All	All	All	All

References

Reference	Source	Link	Tags
[LPE-17632] LSV-855: Stored XSS with ERC in Commerce catalog - Liferay Issues	MISC	issues.liferay.com
Digital Experience Software Tailored to Your Needs \| Liferay	MISC	liferay.com
CVE-2022-42119 Stored XSS with ERC in Commerce catalog	MISC	portal.liferay.dev
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

Legacy QID Mappings

731101 Liferay Portal Cross-Site Scripting (XSS) Vulnerability (CVE-2022-42119)