CVE-2022-42121
15.11.2022, 01:15
A SQL injection vulnerability in the Layout module in Liferay Portal 7.1.3 through 7.4.3.4, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 17, 7.3 before service pack 3, and 7.4 GA allows remote authenticated attackers to execute arbitrary SQL commands via a crafted payload injected into a page template's 'Name' field.
| Vendor | Product | Version |
|---|---|---|
| liferay | liferay_portal | 7.1.3 ≤ 𝑥 ≤ 7.4.3.4 |
| liferay | digital_experience_platform | 7.1 |
| liferay | digital_experience_platform | 7.1:fix_pack_1 |
| liferay | digital_experience_platform | 7.1:fix_pack_10 |
| liferay | digital_experience_platform | 7.1:fix_pack_11 |
| liferay | digital_experience_platform | 7.1:fix_pack_12 |
| liferay | digital_experience_platform | 7.1:fix_pack_13 |
| liferay | digital_experience_platform | 7.1:fix_pack_14 |
| liferay | digital_experience_platform | 7.1:fix_pack_15 |
| liferay | digital_experience_platform | 7.1:fix_pack_16 |
| liferay | digital_experience_platform | 7.1:fix_pack_17 |
| liferay | digital_experience_platform | 7.1:fix_pack_18 |
| liferay | digital_experience_platform | 7.1:fix_pack_19 |
| liferay | digital_experience_platform | 7.1:fix_pack_2 |
| liferay | digital_experience_platform | 7.1:fix_pack_20 |
| liferay | digital_experience_platform | 7.1:fix_pack_21 |
| liferay | digital_experience_platform | 7.1:fix_pack_22 |
| liferay | digital_experience_platform | 7.1:fix_pack_23 |
| liferay | digital_experience_platform | 7.1:fix_pack_24 |
| liferay | digital_experience_platform | 7.1:fix_pack_25 |
| liferay | digital_experience_platform | 7.1:fix_pack_3 |
| liferay | digital_experience_platform | 7.1:fix_pack_4 |
| liferay | digital_experience_platform | 7.1:fix_pack_5 |
| liferay | digital_experience_platform | 7.1:fix_pack_6 |
| liferay | digital_experience_platform | 7.1:fix_pack_7 |
| liferay | digital_experience_platform | 7.1:fix_pack_8 |
| liferay | digital_experience_platform | 7.1:fix_pack_9 |
| liferay | digital_experience_platform | 7.2 |
| liferay | digital_experience_platform | 7.2:fix_pack_1 |
| liferay | digital_experience_platform | 7.2:fix_pack_10 |
| liferay | digital_experience_platform | 7.2:fix_pack_11 |
| liferay | digital_experience_platform | 7.2:fix_pack_12 |
| liferay | digital_experience_platform | 7.2:fix_pack_13 |
| liferay | digital_experience_platform | 7.2:fix_pack_14 |
| liferay | digital_experience_platform | 7.2:fix_pack_15 |
| liferay | digital_experience_platform | 7.2:fix_pack_2 |
| liferay | digital_experience_platform | 7.2:fix_pack_3 |
| liferay | digital_experience_platform | 7.2:fix_pack_4 |
| liferay | digital_experience_platform | 7.2:fix_pack_5 |
| liferay | digital_experience_platform | 7.2:fix_pack_6 |
| liferay | digital_experience_platform | 7.2:fix_pack_7 |
| liferay | digital_experience_platform | 7.2:fix_pack_8 |
| liferay | digital_experience_platform | 7.2:fix_pack_9 |
| liferay | dxp | 7.3 |
| liferay | dxp | 7.3:sp1 |
| liferay | dxp | 7.3:sp2 |
| liferay | dxp | 7.4:ga1 |
| liferay | liferay_portal | 7.1.0 ≤ 𝑥 ≤ 7.4.2 |
𝑥
= Vulnerable software versions
References