CVE-2022-42116
Status: ModifiedMedium (6.1)—
A Cross-site scripting (XSS) vulnerability in the Frontend Editor module's integration with CKEditor in Liferay Portal 7.3.2 through 7.4.3.14, and Liferay DXP 7.3 before update 6, and 7.4 before update 15 allows remote attackers to inject arbitrary web script or HTML via the (1) name, or (2) namespace parameter.
CVSS
- Version: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Base score: 6.1
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days: 0.55%
- Percentile among all scored CVEs: 44
- Score date: 10/6/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
Affected technologies (2)
CWEs
- CWE-79
- CWE-79
References
Raw JSON (NVD)
Show
{
"id": "CVE-2022-42116",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2022-42116",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2025-05-13T14:38:42.434125Z"
}
}
],
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "CHANGED",
"version": "3.1",
"baseScore": 6.1,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"integrityImpact": "LOW",
"userInteraction": "REQUIRED",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "NONE",
"confidentialityImpact": "LOW"
},
"impactScore": 2.7,
"exploitabilityScore": 2.8
},
{
"type": "Secondary",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"cvssData": {
"scope": "CHANGED",
"version": "3.1",
"baseScore": 6.1,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"integrityImpact": "LOW",
"userInteraction": "REQUIRED",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "NONE",
"confidentialityImpact": "LOW"
},
"impactScore": 2.7,
"exploitabilityScore": 2.8
}
]
},
"affected": [
{
"source": "cve@mitre.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2022-10-18T21:15:16.373",
"references": [
{
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42116",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42116",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
},
{
"type": "Secondary",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A Cross-site scripting (XSS) vulnerability in the Frontend Editor module's integration with CKEditor in Liferay Portal 7.3.2 through 7.4.3.14, and Liferay DXP 7.3 before update 6, and 7.4 before update 15 allows remote attackers to inject arbitrary web script or HTML via the (1) name, or (2) namespace parameter."
},
{
"lang": "es",
"value": "Una vulnerabilidad de Cross-site scripting (XSS) en la integración del módulo Frontend Editor con CKEditor en Liferay Portal versiones 7.3.2 hasta 7.4.3.14, y Liferay DXP versiones 7.3 anteriores a update 6, y versiones 7.4 anteriores a update 15, permite a atacantes remotos inyectar script web o HTML arbitrarios por medio del parámetro (1) name, o (2) namespace"
}
],
"lastModified": "2026-07-09T01:17:46.993",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:liferay:dxp:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5C0B6536-11D4-48A1-8EC8-FCDFFFD07540",
"versionEndExcluding": "7.3"
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "21C55D41-DB66-494D-BEEB-BDAC7CB4B31B"
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:sp1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9D75A0FF-BAEA-471A-87B2-8EC2A9F0A6B5"
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:sp2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D86CDCC0-9655-477B-83FA-ADDBB5AF43A2"
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:sp3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1CF5B84B-1719-4581-8474-C55CEFFD8305"
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:update_1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D60CDAA3-6029-4904-9D08-BB221BCFD7C3"
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:update_2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B66F47E9-3D82-497E-BD84-E47A65FAF8C3"
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:update_3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A0BA4856-59DF-427C-959F-3B836314F5D5"
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:update_4:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F3A5ADE1-4743-4A78-9FCC-CEB857012A5B"
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:update_5:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2B420A18-5C8B-470F-9189-C84F8DAA74D5"
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:ga1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "186D21EA-CD15-4F50-B129-6EF8DCB4FE50"
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "46AF397F-A95C-4FAD-A6EA-CB623B7A262A"
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_10:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3B8C3B3F-1BBB-47A5-A789-B207B6346FFF"
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_11:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AD5D1171-954A-4E75-813D-E8392CFE4029"
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_12:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F148098A-D867-4C8B-9632-6B7F24D50C30"
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_13:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8A112ED2-27C2-45E3-8FA0-6043F7D3BEED"
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_14:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0744AC04-9663-4DA1-9657-EC5BF0C68499"
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C2C2351E-BDEE-4A79-A00C-6520B54996EF"
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "25F5C3E9-CBB0-4114-91A4-41F0E666026A"
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_4:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5E2B5687-B311-460E-A562-D754AF271F8E"
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_5:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B49D0CB9-8ED7-46AB-9BA5-7235A2CD9117"
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_6:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DF169364-096C-4294-B89F-C07AF1DCC9C4"
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_7:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "30CB2C54-1A20-4226-ACC6-AC8131899AE2"
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_8:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "65693260-5B0F-47AA-BF08-D2979997A40A"
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_9:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C9116909-04C3-4040-B945-4A6225425520"
},
{
"criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5DC7AD5B-063F-4C30-A9D9-08C3F90185D9",
"versionEndExcluding": "7.4.3.15",
"versionStartIncluding": "7.3.2"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "cve@mitre.org"
}