GHSA-x43w-xphx-86w3

Liferay Portal Vulnerable to XSS in the Object Module

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-42115

Packages

Ecosystem	Package	Affected	Fixed in
Maven	com.liferay:com.liferay.object.web	< 1.0.99	1.0.99

Details

As written in the advisory (Markdown source, shown as plain text).

Cross-site scripting (XSS) vulnerability in the Object module's edit object details page in Liferay Object Web before 1.0.99 from Liferay Portal (7.4.3.4 through 7.4.3.36) allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into the object field's `Label` text field.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-42115 advisory
https://github.com/liferay/liferay-portal/commit/51cc09f972c1ffb7186680b3b73f463406daae46 web
https://github.com/liferay/liferay-portal package
https://liferay.atlassian.net/browse/LPE-17613 web
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2022-42115?p_r_p_assetEntryId=121613168&_com_li… web
https://web.archive.org/web/20221019053234/https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/co… web
http://liferay.com web