CVE-2022-42112
Estado: ModificadaMedia (5.4)—
A Cross-site scripting (XSS) vulnerability in the Portal Search module's Sort widget in Liferay Portal 7.2.0 through 7.4.3.24, and Liferay DXP 7.2 before fix pack 19, 7.3 before update 5, and DXP 7.4 before update 25 allows remote attackers to inject arbitrary web script or HTML via a crafted payload.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- Puntuación base: 5.4
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.53%
- Percentil entre todas las CVEs puntuadas: 43
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (3)
CWE
- CWE-79
- CWE-79
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2022-42112",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2022-42112",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2025-05-10T02:43:43.584517Z"
}
}
],
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "CHANGED",
"version": "3.1",
"baseScore": 5.4,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"integrityImpact": "LOW",
"userInteraction": "REQUIRED",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "LOW",
"confidentialityImpact": "LOW"
},
"impactScore": 2.7,
"exploitabilityScore": 2.3
},
{
"type": "Secondary",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"cvssData": {
"scope": "CHANGED",
"version": "3.1",
"baseScore": 5.4,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"integrityImpact": "LOW",
"userInteraction": "REQUIRED",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "LOW",
"confidentialityImpact": "LOW"
},
"impactScore": 2.7,
"exploitabilityScore": 2.3
}
]
},
"affected": [
{
"source": "cve@mitre.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2022-10-18T21:15:16.203",
"references": [
{
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42112",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42112",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
},
{
"type": "Secondary",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A Cross-site scripting (XSS) vulnerability in the Portal Search module's Sort widget in Liferay Portal 7.2.0 through 7.4.3.24, and Liferay DXP 7.2 before fix pack 19, 7.3 before update 5, and DXP 7.4 before update 25 allows remote attackers to inject arbitrary web script or HTML via a crafted payload."
},
{
"lang": "es",
"value": "Una vulnerabilidad de tipo Cross-site scripting (XSS) en el widget Sort del módulo Portal Search en Liferay Portal versiones 7.2.0 hasta 7.4.3.24, y Liferay DXP 7.2 versiones anteriores a fix pack 19, 7.3 anteriores a update 5, y DXP versiones 7.4 anteriores a update 25, permite a atacantes remotos inyectar scripts web o HTML arbitrarios por medio de una carga útil diseñada"
}
],
"lastModified": "2026-07-09T01:17:46.330",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AF8EBC77-BA94-4AA8-BAF0-D1E3C9146459",
"versionEndExcluding": "7.2"
},
{
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.2:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0DCF7F39-A198-4F7E-84B7-90C88C1BAA96"
},
{
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E7E68DF8-749B-4284-A7C9-929701A86B36"
},
{
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_10:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "340DF1FE-5720-4516-BA51-F2197A654409"
},
{
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_11:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "97E155DE-05C6-4559-94A8-0EFEB958D0C9"
},
{
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_12:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0635FB5F-9C90-49C7-A9EF-00C0396FCCAE"
},
{
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_13:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "77523B76-FC26-41B1-A804-7372E13F4FB2"
},
{
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_14:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B15397B8-5087-4239-AE78-D3C37D59DE83"
},
{
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_15:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "311EE92A-0EEF-4556-A52F-E6C9522FA2DD"
},
{
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_18:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "54E499E6-C747-476B-BFE2-C04D9F8744F3"
},
{
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7CECAA19-8B7F-44C8-8059-6D4F2105E196"
},
{
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "68CBCEEB-7C28-4769-813F-3F01E33D2E08"
},
{
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_4:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C0CB4927-A361-4DFA-BDB8-A454EA2894AB"
},
{
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_5:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B2B771B7-D5CB-4778-A3A8-1005E4EE134C"
},
{
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_6:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3B9DB383-3791-4A43-BA4D-7695B203E736"
},
{
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_7:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "13F02D77-20E9-4F32-9752-511EB71E6704"
},
{
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_8:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6353CC8F-A6D4-4A0C-8D68-290CD8DEB4F8"
},
{
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_9:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "759DDB90-6A89-4E4F-BD04-F70EFA5343B0"
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "21C55D41-DB66-494D-BEEB-BDAC7CB4B31B"
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:sp1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9D75A0FF-BAEA-471A-87B2-8EC2A9F0A6B5"
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:sp2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D86CDCC0-9655-477B-83FA-ADDBB5AF43A2"
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:sp3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1CF5B84B-1719-4581-8474-C55CEFFD8305"
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:update_1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D60CDAA3-6029-4904-9D08-BB221BCFD7C3"
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:update_2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B66F47E9-3D82-497E-BD84-E47A65FAF8C3"
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:update_3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A0BA4856-59DF-427C-959F-3B836314F5D5"
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:update_4:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F3A5ADE1-4743-4A78-9FCC-CEB857012A5B"
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:ga1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "186D21EA-CD15-4F50-B129-6EF8DCB4FE50"
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "46AF397F-A95C-4FAD-A6EA-CB623B7A262A"
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_10:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3B8C3B3F-1BBB-47A5-A789-B207B6346FFF"
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_11:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AD5D1171-954A-4E75-813D-E8392CFE4029"
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_12:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F148098A-D867-4C8B-9632-6B7F24D50C30"
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_13:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8A112ED2-27C2-45E3-8FA0-6043F7D3BEED"
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_14:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0744AC04-9663-4DA1-9657-EC5BF0C68499"
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_15:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5703FE2B-011A-4A40-AB67-B989438F2183"
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_16:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "41A54448-B1AB-4E92-8523-5D4A46A83533"
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_17:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A96A2A4A-3EB3-4074-A846-EC6EECC04B43"
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_18:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "56DAE678-10B9-419D-9F5D-96E3AC3A6E4A"
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_19:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "064F4C28-B1F5-44C2-91AA-A09FD56EC0B9"
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C2C2351E-BDEE-4A79-A00C-6520B54996EF"
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_20:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "814D0CE3-B89F-423C-B1E3-47BD0A474491"
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_21:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "58DB7C5A-B4E3-410A-B491-3F322B340BDF"
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_22:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "86B581B6-02B0-40B9-BB5C-E28FC51042DB"
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_23:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E7EFBC14-6785-4435-BA96-D77A857BC1C8"
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_24:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "585635F8-53DC-4F64-BF6B-C6F72A5F4D29"
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "25F5C3E9-CBB0-4114-91A4-41F0E666026A"
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_4:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5E2B5687-B311-460E-A562-D754AF271F8E"
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_5:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B49D0CB9-8ED7-46AB-9BA5-7235A2CD9117"
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_6:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DF169364-096C-4294-B89F-C07AF1DCC9C4"
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_7:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "30CB2C54-1A20-4226-ACC6-AC8131899AE2"
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_8:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "65693260-5B0F-47AA-BF08-D2979997A40A"
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_9:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C9116909-04C3-4040-B945-4A6225425520"
},
{
"criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2DAC6B76-A5D8-4164-8DF8-1058858F78EE",
"versionEndExcluding": "7.4.3.25",
"versionStartIncluding": "7.2.0"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "cve@mitre.org"
}