Liferay Portal and Liferay DXP Vulnerable to XSS via the Commerce Module

MEDIO 5.4CVE-2022-42119 · GHSA-wjfm-qxg2-q679 · Published 15/11/2022 · updated 09/07/2026

En resumen

CVE-2022-42119 es una vulnerabilidad MEDIO (CVSS 5.4) que afecta a com.liferay.commerce:com.liferay.commerce.catalog.web, com.liferay.portal:release.dxp.bom, dxp (liferay).
Probabilidad de explotación en los próximos 30 días (EPSS): 0.44%, mayor que el 38.0% de las vulnerabilidades.
Solución: actualizar a 4.0.8, 7.3.10.u8 o posterior.

Package	Affected versions	Patched versions
com.liferay.commerce:com.liferay.commerce.catalog.web Maven	`< 4.0.8`	`4.0.8`
com.liferay.portal:release.dxp.bom Maven	`≥ 7.3.0, < 7.3.10.u8`	`7.3.10.u8`
dxp liferay	`= 7.3`	No fix yet
liferay portal liferay	`≥ 7.3.5, ≤ 7.4.2`	No fix yet

Description

Certain Liferay products are vulnerable to Cross Site Scripting (XSS) via the Commerce module. This affects the Commerce module before 4.0.8 from Liferay Portal (7.3.5 through 7.4.2) and Liferay DXP 7.3 before update 8.

NVD description

Certain Liferay products are vulnerable to Cross Site Scripting (XSS) via the Commerce module. This affects Liferay Portal 7.3.5 through 7.4.2 and Liferay DXP 7.3 before update 8.

References

nvd.nist.gov/vuln/detail/CVE-2022-42119 · ADVISORY
liferay/liferay-portal commit 2e02110 · WEB
liferay/liferay-portal · PACKAGE
issues.liferay.com/browse/LPE-17632 · WEB
web.archive.org/web/20221115040019/https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42119 · WEB
liferay.com · WEB
portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42119 · Vendor Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free