CVE-2022-42121

Description

A SQL injection vulnerability in the Layout module in Liferay Portal 7.1.3 through 7.4.3.4, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 17, 7.3 before service pack 3, and 7.4 GA allows remote authenticated attackers to execute arbitrary SQL commands via a crafted payload injected into a page templates Name field.

Risk Information

Base Score

8.8

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score

Exploitation Probability

0.605

Associated Vulnerability

Vulnerability	OS Platform
Multiple vulnerabilities are fixed in Liferay - release.dxp.bom 7.2.10	Windows
Vulnerabilities CVE-2022-42110,CVE-2022-42118,CVE-2022-42132,CVE-2022-42121 are fixed in Liferay - release.dxp.bom 7.1.10	Windows
Vulnerabilities CVE-2022-42121 are fixed in Liferay - com.liferay.layout.page.template.service 4.0.17	Windows
Multiple vulnerabilities are fixed in Liferay - release.dxp.bom for Linux 7.2.10	Linux
Vulnerabilities CVE-2022-42110,CVE-2022-42118,CVE-2022-42132,CVE-2022-42121 are fixed in Liferay - release.dxp.bom for Linux 7.1.10	Linux
Vulnerabilities CVE-2022-42121 are fixed in Liferay - com.liferay.layout.page.template.service for Linux 4.0.17	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234