GitHub Advisoryadvisory · Maven

GHSA-hffx-r282-w2g9 Path Traversal in Liferay Portal

HIGH Published 2022-11-15 Modified 2025-09-05 Official page ↗
Aliases
CVE-2022-42123
Ecosystem
Maven
Packages
com.liferay.portal:release.portal.bom
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-22
Reviewed
2022-11-21

Affected packages

• Maven com.liferay.portal:release.portal.bom: >= 7.3.3, < 7.4.3.19 → fixed in 7.4.3.19

Description

A Zip slip vulnerability in the Elasticsearch Connector in Liferay Portal 7.3.3 through 7.4.3.18, and Liferay DXP 7.3 before update 6, and 7.4 before update 19 allows attackers to create or overwrite existing files on the filesystem via the installation of a malicious Elasticsearch Sidecar plugin.

Related

Alias · CVE (1)

  • CVE-2022-42123 A Zip slip vulnerability in the Elasticsearch Connector in Liferay Portal 7.3.3 through 7.4.3.18, and Liferay DXP 7.3 before update 6, and… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References