GitHub Advisoryadvisory · Maven

GHSA-r5fj-j449-vqw2 Liferay Portal and Liferay DXP Vulnerable to SQL Injection via the Fragment Module

CRITICAL Published 2022-11-15 Modified 2025-09-05 Official page ↗
Aliases
CVE-2022-42120
Ecosystem
Maven
Packages
com.liferay:com.liferay.fragment.service, com.liferay.portal:release.dxp.bom
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-89
Reviewed
2025-07-15

Affected packages

• Maven com.liferay:com.liferay.fragment.service: < 4.0.33 → fixed in 4.0.33 • Maven com.liferay.portal:release.dxp.bom: >= 7.3.0, < 7.3.10.u4 → fixed in 7.3.10.u4 • Maven com.liferay.portal:release.dxp.bom: >= 7.4.0, < 7.4.13.u17 → fixed in 7.4.13.u17

Description

A SQL injection vulnerability in the Fragment module before 4.0.33 from Liferay Portal (7.3.3 through 7.4.3.16), and Liferay DXP 7.3 before update 4, and 7.4 before update 17 allows attackers to execute arbitrary SQL commands via a PortletPreferences' `namespace` attribute.

Related

Alias · CVE (1)

  • CVE-2022-42120 A SQL injection vulnerability in the Fragment module in Liferay Portal 7.3.3 through 7.4.3.16, and Liferay DXP 7.3 before update 4, and 7.4… vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References