CVE-2022-42112
Liferay Portal and Liferay DXP Vulnerable to XSS via the Portal Search Module
A Cross-site scripting (XSS) vulnerability in the Portal Search module's Sort widget in Liferay Portal 7.2.0 through 7.4.3.24, and Liferay DXP 7.2 before fix pack 19, 7.3 before update 5, and DXP 7.4 before update 25 allows remote attackers to inject arbitrary web script or HTML via a crafted payload.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
A Cross-site scripting (XSS) vulnerability in the Portal Search module's Sort widget in Liferay Portal 7.2.0 through 7.4.3.24, and Liferay DXP 7.2 before fix pack 19, 7.3 before update 5, and DXP 7.4 before update 25 allows remote attackers to inject arbitrary web script or HTML via a crafted payload.
- Record
CVE-2022-42112- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List
A Cross-site scripting (XSS) vulnerability in the Portal Search module's Sort widget in Liferay Portal 7.2.0 through 7.4.3.24, and Liferay DXP 7.2 before fix pack 19, 7.3 before update 5, and DXP 7.4 before update 25 allows remote attackers to inject arbitrary web script or HTML via a crafted payload.
- Record
CVE-2022-42112- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2022-45198
A Cross-site scripting (XSS) vulnerability in the Portal Search module's Sort widget in Liferay Portal 7.2.0 through 7.4.3.24, and Liferay DXP 7.2 before fix pack 19, 7.3 before update 5, and DXP 7.4 before update 25 allows remote attackers to inject arbitrary web script or HTML via a crafted payload.
- Record
EUVD-2022-45198- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-7f7g-vhff-mjqj
Liferay Portal and Liferay DXP Vulnerable to XSS via the Portal Search Module
A Cross-site scripting (XSS) vulnerability in the Portal Search module's Sort widget before 6.0.45 from Liferay Portal (7.2.0 through 7.4.3.24), and Liferay DXP 7.2 before fix pack 19, 7.3 before update 5, and DXP 7.4 before update 25 allows remote attackers to inject arbitrary web script or HTML via a crafted payload.
- Record
GHSA-7f7g-vhff-mjqj- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
A Cross-site scripting (XSS) vulnerability in the Portal Search module's Sort widget in Liferay Portal 7.2.0 through 7.4.3.24, and Liferay DXP 7.2 before fix pack 19, 7.3 before update 5, and DXP 7.4 before update 25 allows remote attackers to inject arbitrary web script or HTML via a crafted payload.
- Record
CVE-2022-42112- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-7f7g-vhff-mjqj
Liferay Portal and Liferay DXP Vulnerable to XSS via the Portal Search Module
A Cross-site scripting (XSS) vulnerability in the Portal Search module's Sort widget before 6.0.45 from Liferay Portal (7.2.0 through 7.4.3.24), and Liferay DXP 7.2 before fix pack 19, 7.3 before update 5, and DXP 7.4 before update 25 allows remote attackers to inject arbitrary web script or HTML via a crafted payload.
- Record
GHSA-7f7g-vhff-mjqj- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
com.liferay:com.liferay.portal.search.webMaven |
before 6.0.45 | 6.0.45 |
com.liferay.portal:release.dxp.bomMaven |
7.2.0 up to 7.2.10.fp19 | 7.2.10.fp19 |
com.liferay.portal:release.dxp.bomMaven |
7.3.0 up to 7.3.10.u5 | 7.3.10.u5 |
com.liferay.portal:release.dxp.bomMaven |
7.4.0 up to 7.4.13.u25 | 7.4.13.u25 |
com.liferay:com.liferay.portal.search.webMaven |
before 6.0.45, plus listed versions 1.0.01.0.11.0.21.0.31.0.4 Show 45 moreShow less1.1.01.1.11.1.101.1.111.1.121.1.131.1.141.1.151.1.161.1.171.1.181.1.191.1.21.1.201.1.211.1.221.1.31.1.41.1.51.1.61.1.71.1.81.1.91.2.01.2.11.2.21.2.31.2.41.2.51.3.01.3.11.3.21.3.31.3.41.3.51.3.61.3.71.3.81.3.92.0.02.0.12.0.102.0.112.0.122.0.13 |
6.0.45 |
com.liferay.portal:release.dxp.bomMaven |
7.2.0 up to 7.2.10.fp19, plus listed versions 7.2.17.2.107.2.10.fp17.2.10.fp1-17.2.10.fp10 Show 16 moreShow less7.2.10.fp117.2.10.fp127.2.10.fp137.2.10.fp147.2.10.fp157.2.10.fp167.2.10.fp177.2.10.fp187.2.10.fp27.2.10.fp37.2.10.fp47.2.10.fp57.2.10.fp67.2.10.fp77.2.10.fp87.2.10.fp9 |
7.2.10.fp19 |
com.liferay.portal:release.dxp.bomMaven |
7.3.0 up to 7.3.10.u5, plus listed versions 7.3.107.3.10.ep37.3.10.ep47.3.10.ep57.3.10.fp17.3.10.fp27.3.10.u4 |
7.3.10.u5 |
com.liferay.portal:release.dxp.bomMaven |
7.4.0 up to 7.4.13.u25, plus listed versions 7.4.10.ep17.4.117.4.127.4.137.4.13.u1 Show 19 moreShow less7.4.13.u107.4.13.u157.4.13.u167.4.13.u177.4.13.u187.4.13.u197.4.13.u27.4.13.u207.4.13.u217.4.13.u227.4.13.u237.4.13.u247.4.13.u37.4.13.u47.4.13.u57.4.13.u67.4.13.u77.4.13.u87.4.13.u9 |
7.4.13.u25 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-42112 is a medium vulnerability (CVSS 5.4) in Liferay Dxp, published October 18, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.60%, the 48th percentile. Fixed in com.liferay:com.liferay.portal.search.web 6.0.45.
References
portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42112
nvd.nist.gov/vuln/detail/CVE-2022-42112
liferay.com
github.com/liferay/liferay-portal/commit/1f6521605152c0f8f82f490300215f08f885fe48
liferay.atlassian.net/browse/LPE-17536
liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2022-42112?p_r_p_assetEntryId=121612934&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121612934%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse
Show 4 moreShow less
web.archive.org/web/20220701000000*/https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42112
Left out here: 520 versions. The JSON record has them.