CVE-2022-42120 — Vulnerability in...

CRITICAL

Liferay Portal and Liferay DXP Vulnerable to SQL Injection via the Fragment Module

Published November 15, 2022Updated September 5, 2025Source: osv

Summary

A SQL injection vulnerability in the Fragment module before 4.0.33 from Liferay Portal (7.3.3 through 7.4.3.16), and Liferay DXP 7.3 before update 4, and 7.4 before update 17 allows attackers to execute arbitrary SQL commands via a PortletPreferences' `namespace` attribute.

Advisory Timeline

First published November 15, 2022 (1427 days ago).
Last revised September 5, 2025 — 1025 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Maven

Update com.liferay:com.liferay.fragment.service to 4.0.33 or later

<!-- Update pom.xml dependency version to 4.0.33 for com.liferay:com.liferay.fragment.service -->

Maven

Update com.liferay.portal:release.dxp.bom to 7.3.10.u4 or later

<!-- Update pom.xml dependency version to 7.3.10.u4 for com.liferay.portal:release.dxp.bom -->

Maven

Update com.liferay.portal:release.dxp.bom to 7.4.13.u17 or later

<!-- Update pom.xml dependency version to 7.4.13.u17 for com.liferay.portal:release.dxp.bom -->

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (3)

Affects 1 ecosystem: maven (2).

Package	Ecosystem	Affected	Fixed In
com.liferay:com.liferay.fragment.service	maven	1.0.0, 1.0.1, 1.0.10, 1.0.11 (+266 more)	4.0.33
com.liferay.portal:release.dxp.bom	maven	7.3.10, 7.3.10.ep3, 7.3.10.ep4, 7.3.10.ep5 (+2 more)	7.3.10.u4
com.liferay.portal:release.dxp.bom	maven	7.4.10.ep1, 7.4.11, 7.4.12, 7.4.13 (+12 more)	7.4.13.u17

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-89
SQL InjectionMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.8 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2022-42120?: Liferay Portal and Liferay DXP Vulnerable to SQL Injection via the Fragment Module This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.8/10).
How do I check if my project is affected by CVE-2022-42120?: CVE-2022-42120 affects com.liferay:com.liferay.fragment.service and com.liferay.portal:release.dxp.bom. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2022-42120 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

9.8

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-r5fj-j449-vqw2

Related CVEs

CVE-2024-38002
CRITICAL
Liferay Portal and Liferay DXP Workflow Component Does Not Check User Permissions
CVE-2024-25603
CRITICAL
Liferay Portal's Dynamic Data Mapping module's DDMForm and Liferay DXP vulnerable to stored Cross-site Scripting
CVE-2023-40191
CRITICAL
Liferay Portal and Liferay DXP vulnerable to reflected Cross-site Scripting
CVE-2023-44311
CRITICAL
Liferay Portal and Liferay DXP Vulnerable to XSS via the OAuth2ProviderApplicationRedirect Class
CVE-2024-25602
CRITICAL
Liferay Portal and Liferay DXP's Users Admin module vulnerable to stored Cross-site Scripting
CVE-2024-25610
CRITICAL
Liferay Portal has a Stored XSS with Blog entries (Insecure defaults)
CVE-2023-42497
CRITICAL
Liferay Portal and Liferay DXP Vulnerable to Reflected XSS via the Export for Translation Page
CVE-2024-25147
CRITICAL
Liferay Portal and Liferay DXP vulnerable to Cross-site Scripting

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies