Liferay Portal and Liferay DXP Vulnerable to XSS via the Commerce Module

MITTEL 5.4CVE-2022-42119 · GHSA-wjfm-qxg2-q679 · Published 15/11/2022 · updated 09/07/2026

Kurz gesagt

CVE-2022-42119 ist eine Schwachstelle (MITTEL (CVSS 5.4)) in com.liferay.commerce:com.liferay.commerce.catalog.web, com.liferay.portal:release.dxp.bom, dxp (liferay).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.44%, höher als bei 38.0% aller Schwachstellen.
Abhilfe: auf 4.0.8, 7.3.10.u8 oder neuer aktualisieren.

Package	Affected versions	Patched versions
com.liferay.commerce:com.liferay.commerce.catalog.web Maven	`< 4.0.8`	`4.0.8`
com.liferay.portal:release.dxp.bom Maven	`≥ 7.3.0, < 7.3.10.u8`	`7.3.10.u8`
dxp liferay	`= 7.3`	No fix yet
liferay portal liferay	`≥ 7.3.5, ≤ 7.4.2`	No fix yet

Description

Certain Liferay products are vulnerable to Cross Site Scripting (XSS) via the Commerce module. This affects the Commerce module before 4.0.8 from Liferay Portal (7.3.5 through 7.4.2) and Liferay DXP 7.3 before update 8.

NVD description

Certain Liferay products are vulnerable to Cross Site Scripting (XSS) via the Commerce module. This affects Liferay Portal 7.3.5 through 7.4.2 and Liferay DXP 7.3 before update 8.

References

nvd.nist.gov/vuln/detail/CVE-2022-42119 · ADVISORY
liferay/liferay-portal commit 2e02110 · WEB
liferay/liferay-portal · PACKAGE
issues.liferay.com/browse/LPE-17632 · WEB
web.archive.org/web/20221115040019/https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42119 · WEB
liferay.com · WEB
portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42119 · Vendor Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free