Servers and applications
CVE-2022-42115
Cross-site scripting (XSS) vulnerability in the Object module's edit object details page in Liferay Portal 7.4.3.4 through 7.4.3.36 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into the object field's `Label` text field.
- Severity
- Medium 5.4
- Published
- 18 Oct 2022
- Last changed
- 9 Jul 2026
- Added to UpHeron
- 1 Nov 2026
- Fixed in
- 7.4.3.37
- Sources
- NVD
Affected software
| Software | Affected versions |
|---|---|
Liferay Portal / DXPServers and applications · cpe:a:liferay:liferay_portal |
|