GitHub Advisoryadvisory · Maven

GHSA-5j86-vmpx-42pc Liferay Portal Path Traversal Vulnerability via the Hypermedia REST APIs Module

HIGH Published 2022-09-23 Modified 2025-07-16 Official page ↗
Aliases
CVE-2022-28981
Ecosystem
Maven
Packages
com.liferay:com.liferay.headless.discovery.web
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-22
Reviewed
2025-07-16

Affected packages

• Maven com.liferay:com.liferay.headless.discovery.web: < 4.0.12 → fixed in 4.0.12

Description

Path traversal vulnerability in the Hypermedia REST APIs module before 4.0.12 from Liferay Portal (7.4.0 through 7.4.2) allows remote attackers to access files outside of com.liferay.headless.discovery.web/META-INF/resources via the `parameter` parameter.

Related

Alias · CVE (1)

  • CVE-2022-28981 Path traversal vulnerability in the Hypermedia REST APIs module in Liferay Portal 7.4.0 through 7.4.2 allows remote attackers to access… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References