~ / search / GHSA-wjfm-qxg2-q679

GHSA-wjfm-qxg2-q679

Liferay Portal and Liferay DXP Vulnerable to XSS via the Commerce Module

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-42119

Packages

EcosystemPackageAffectedFixed in
Maven com.liferay.commerce:com.liferay.commerce.catalog.web < 4.0.8 4.0.8
Maven com.liferay.portal:release.dxp.bom >= 7.3.0, < 7.3.10.u8 7.3.10.u8

Details

As written in the advisory (Markdown source, shown as plain text).

Certain Liferay products are vulnerable to Cross Site Scripting (XSS) via the Commerce module. This affects the Commerce module before 4.0.8 from Liferay Portal (7.3.5 through 7.4.2) and Liferay DXP 7.3 before update 8.

References

External links from the advisory. They lead to third-party sites.