Lucene search

MitreCVE-2022-42124

HistoryNov 15, 2022 - 1:15 a.m.

CVE-2022-42124

2022-11-1501:15:13

CWE-1333

mitre

web.nvd.nist.gov

cve

2022

42124

redos

vulnerability

liferay portal

dxp

remote attackers

server resources

crafted payload

layout prototype

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.005

Percentile

75.9%

JSON

ReDoS vulnerability in LayoutPageTemplateEntryUpgradeProcess in Liferay Portal 7.3.2 through 7.4.3.4 and Liferay DXP 7.2 fix pack 9 through fix pack 18, 7.3 before update 4, and DXP 7.4 GA allows remote attackers to consume an excessive amount of server resources via a crafted payload injected into the ‘name’ field of a layout prototype.

Affected configurations

Nvd

Node

liferaydigital_experience_platformMatch7.2fix_pack_10

liferaydigital_experience_platformMatch7.2fix_pack_11

liferaydigital_experience_platformMatch7.2fix_pack_12

liferaydigital_experience_platformMatch7.2fix_pack_13

liferaydigital_experience_platformMatch7.2fix_pack_14

liferaydigital_experience_platformMatch7.2fix_pack_15

liferaydigital_experience_platformMatch7.2fix_pack_16

liferaydigital_experience_platformMatch7.2fix_pack_9

liferaydigital_experience_platformMatch7.3-

liferaydigital_experience_platformMatch7.4-

liferayliferay_portalRange7.3.2–7.4.3.5

VendorProductVersionCPE
liferaydigital_experience_platform7.2cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_10:*:*:*:*:*:*
liferaydigital_experience_platform7.2cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_11:*:*:*:*:*:*
liferaydigital_experience_platform7.2cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_12:*:*:*:*:*:*
liferaydigital_experience_platform7.2cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_13:*:*:*:*:*:*
liferaydigital_experience_platform7.2cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_14:*:*:*:*:*:*
liferaydigital_experience_platform7.2cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_15:*:*:*:*:*:*
liferaydigital_experience_platform7.2cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_16:*:*:*:*:*:*
liferaydigital_experience_platform7.2cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_9:*:*:*:*:*:*
liferaydigital_experience_platform7.3cpe:2.3:a:liferay:digital_experience_platform:7.3:-:*:*:*:*:*:*
liferaydigital_experience_platform7.4cpe:2.3:a:liferay:digital_experience_platform:7.4:-:*:*:*:*:*:*

Vendor	Product	Version	CPE
liferay	digital_experience_platform	7.2	cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_10::::::
liferay	digital_experience_platform	7.2	cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_11::::::
liferay	digital_experience_platform	7.2	cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_12::::::
liferay	digital_experience_platform	7.2	cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_13::::::
liferay	digital_experience_platform	7.2	cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_14::::::
liferay	digital_experience_platform	7.2	cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_15::::::
liferay	digital_experience_platform	7.2	cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_16::::::
liferay	digital_experience_platform	7.2	cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_9::::::
liferay	digital_experience_platform	7.3	cpe:2.3:a:liferay:digital_experience_platform:7.3:-::::::
liferay	digital_experience_platform	7.4	cpe:2.3:a:liferay:digital_experience_platform:7.4:-::::::

Rows per page:

1-10 of 111

References

liferay.com

issues.liferay.com/browse/LPE-17435

issues.liferay.com/browse/LPE-17535

portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42124

Social References

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.005

Percentile

75.9%

JSON

Related for CVE-2022-42124