Liferay Portal and Liferay DXP Vulnerable to XSS via the Document Library Module

🗓️ 19 Oct 2022 12:00:23Reported by GitHub Advisory DatabaseType

Liferay Portal and DXP have XSS vulnerability in Document Library module allowing remote script injection.

Reporter	Title	Published	Views	Family All 14
CNNVD	Liferay Portal cross-site scripting vulnerabilities	18 Oct 202200:00	–	cnnvd
CVE	CVE-2022-42113	18 Oct 202200:00	–	cve
Cvelist	CVE-2022-42113	18 Oct 202200:00	–	cvelist
EUVD	EUVD-2022-45199	3 Oct 202520:07	–	euvd
Mend	CVE-2022-42113	18 Oct 202200:00	–	mend
NVD	CVE-2022-42113	18 Oct 202221:15	–	nvd
osv_ghsa	GHSA-R32W-V775-5952 Liferay Portal and Liferay DXP Vulnerable to XSS via the Document Library Module	19 Oct 202212:00	–	osv_ghsa
Prion	Cross site scripting	18 Oct 202221:15	–	prion
Positive Technologies	PT-2022-26258	18 Oct 202200:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2022-42113: Improper Neutralization of Input During Web Page Generation	18 Oct 202200:00	–	rapid7

Vulners

Node

com.liferay.portal release.dxp.bomRange7.4.13.u30–7.4.13.u36maven

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2022-42113
liferay	www.liferay.com/
github	www.github.com/liferay/liferay-portal/commit/2e4d17dfe42bb3b12c96527943087cf7e4a7d57e
github	www.github.com/liferay/liferay-portal/commit/62797d3ada6545b12fbfb86dbb229ac9d491d2c2
liferay	www.liferay.atlassian.net/browse/LPE-17615
liferay	www.liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2022-42113
web	www.web.archive.org/web/20221019040338/https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42113
github	www.github.com/advisories/GHSA-r32w-v775-5952

16 Jul 2025 17:55Current

6.1Medium risk

Vulners AI Score6.1

CVSS 3.16.1

EPSS0.00613

SSVC