GitStock

liferay/liferay-portal · Security

Liferay Portal and Liferay DXP Vulnerable to SQL Injection via the Layout Module

GHSA ID
GHSA-gxxj-fhmr-37j9
CVE ID
CVE-2022-42121
Severity
high
Published
Updated
CVSS
8.8 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v3
8.8 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

A SQL injection vulnerability in the Layout module before 4.0.17 from Liferay Portal (7.1.3 through 7.4.3.4), and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 17, 7.3 before service pack 3, and 7.4 GA allows remote authenticated attackers to execute arbitrary SQL commands via a crafted payload injected into a page template's 'Name' field.

CWEs

  • CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

References