Vulnerability Details : CVE-2022-42121
A SQL injection vulnerability in the Layout module in Liferay Portal 7.1.3 through 7.4.3.4, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 17, 7.3 before service pack 3, and 7.4 GA allows remote authenticated attackers to execute arbitrary SQL commands via a crafted payload injected into a page template's 'Name' field.
Vulnerability category: Sql Injection
Products affected by CVE-2022-42121
- cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*
- cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*
- cpe:2.3:a:liferay:dxp:7.1:-:*:*:*:*:*:*
- cpe:2.3:a:liferay:dxp:7.1:fix_pack_1:*:*:*:*:*:*
- cpe:2.3:a:liferay:dxp:7.1:fix_pack_10:*:*:*:*:*:*
- cpe:2.3:a:liferay:dxp:7.1:fix_pack_11:*:*:*:*:*:*
- cpe:2.3:a:liferay:dxp:7.1:fix_pack_12:*:*:*:*:*:*
- cpe:2.3:a:liferay:dxp:7.1:fix_pack_13:*:*:*:*:*:*
- cpe:2.3:a:liferay:dxp:7.1:fix_pack_14:*:*:*:*:*:*
- cpe:2.3:a:liferay:dxp:7.1:fix_pack_15:*:*:*:*:*:*
- cpe:2.3:a:liferay:dxp:7.1:fix_pack_16:*:*:*:*:*:*
- cpe:2.3:a:liferay:dxp:7.1:fix_pack_2:*:*:*:*:*:*
- cpe:2.3:a:liferay:dxp:7.1:fix_pack_3:*:*:*:*:*:*
- cpe:2.3:a:liferay:dxp:7.1:fix_pack_4:*:*:*:*:*:*
- cpe:2.3:a:liferay:dxp:7.1:fix_pack_5:*:*:*:*:*:*
- cpe:2.3:a:liferay:dxp:7.1:fix_pack_6:*:*:*:*:*:*
- cpe:2.3:a:liferay:dxp:7.1:fix_pack_7:*:*:*:*:*:*
- cpe:2.3:a:liferay:dxp:7.1:fix_pack_8:*:*:*:*:*:*
- cpe:2.3:a:liferay:dxp:7.1:fix_pack_9:*:*:*:*:*:*
- cpe:2.3:a:liferay:dxp:7.2:-:*:*:*:*:*:*
- cpe:2.3:a:liferay:dxp:7.2:fix_pack_1:*:*:*:*:*:*
- cpe:2.3:a:liferay:dxp:7.2:fix_pack_2:*:*:*:*:*:*
- cpe:2.3:a:liferay:dxp:7.2:fix_pack_3:*:*:*:*:*:*
- cpe:2.3:a:liferay:dxp:7.2:fix_pack_4:*:*:*:*:*:*
- cpe:2.3:a:liferay:dxp:7.2:fix_pack_5:*:*:*:*:*:*
- cpe:2.3:a:liferay:dxp:7.3:-:*:*:*:*:*:*
- cpe:2.3:a:liferay:dxp:7.1:fix_pack_17:*:*:*:*:*:*
- cpe:2.3:a:liferay:dxp:7.1:fix_pack_18:*:*:*:*:*:*
- cpe:2.3:a:liferay:dxp:7.1:fix_pack_19:*:*:*:*:*:*
- cpe:2.3:a:liferay:dxp:7.1:fix_pack_20:*:*:*:*:*:*
- cpe:2.3:a:liferay:dxp:7.2:fix_pack_6:*:*:*:*:*:*
- cpe:2.3:a:liferay:dxp:7.2:fix_pack_7:*:*:*:*:*:*
- cpe:2.3:a:liferay:dxp:7.2:fix_pack_8:*:*:*:*:*:*
- cpe:2.3:a:liferay:dxp:7.2:fix_pack_9:*:*:*:*:*:*
- cpe:2.3:a:liferay:dxp:7.2:fix_pack_10:*:*:*:*:*:*
- cpe:2.3:a:liferay:dxp:7.1:fix_pack_21:*:*:*:*:*:*
- cpe:2.3:a:liferay:dxp:7.1:fix_pack_22:*:*:*:*:*:*
- cpe:2.3:a:liferay:dxp:7.2:fix_pack_11:*:*:*:*:*:*
- cpe:2.3:a:liferay:dxp:7.1:fix_pack_23:*:*:*:*:*:*
- cpe:2.3:a:liferay:dxp:7.1:fix_pack_24:*:*:*:*:*:*
- cpe:2.3:a:liferay:dxp:7.3:sp1:*:*:*:*:*:*
- cpe:2.3:a:liferay:dxp:7.3:sp2:*:*:*:*:*:*
- cpe:2.3:a:liferay:dxp:7.2:fix_pack_14:*:*:*:*:*:*
- cpe:2.3:a:liferay:dxp:7.1:fix_pack_25:*:*:*:*:*:*
- cpe:2.3:a:liferay:dxp:7.2:fix_pack_12:*:*:*:*:*:*
- cpe:2.3:a:liferay:dxp:7.2:fix_pack_13:*:*:*:*:*:*
- cpe:2.3:a:liferay:dxp:7.4:ga1:*:*:*:*:*:*
- cpe:2.3:a:liferay:dxp:7.2:fix_pack_15:*:*:*:*:*:*
Threat overview for CVE-2022-42121
Top countries where our scanners detected CVE-2022-42121
Top open port discovered on systems with this issue
80
IPs affected by CVE-2022-42121 211
Threat actors abusing to this issue?
Yes
Find out if you* are
affected by CVE-2022-42121!
*Directly or indirectly through your vendors, service providers and 3rd parties.
Powered by
attack surface intelligence
from SecurityScorecard.
Exploit prediction scoring system (EPSS) score for CVE-2022-42121
0.16%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 53 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2022-42121
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
8.8
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
2.8
|
5.9
|
NIST |
CWE ids for CVE-2022-42121
-
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.Assigned by: nvd@nist.gov (Primary)
References for CVE-2022-42121
-
http://liferay.com
Digital Experience Software Tailored to Your Needs | LiferayVendor Advisory
-
https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42121
CVE-2022-42121 SQL injection vulnerability during page template upgradeVendor Advisory
-
https://issues.liferay.com/browse/LPE-17414
[LPE-17414] LSV-961: SQL injection vulnerability during page template upgrade - Liferay IssuesIssue Tracking;Vendor Advisory
Jump to