A SQL injection vulnerability in the Layout module in Liferay Portal 7.1.3 through 7.4.3.4, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 17, 7.3 before service pack 3, and 7.4 GA allows remote authenticated attackers to execute arbitrary SQL commands via a crafted payload injected into a page template's 'Name' field.
References
| Link | Resource |
|---|---|
| http://liferay.com | Vendor Advisory |
| https://issues.liferay.com/browse/LPE-17414 | Issue Tracking Vendor Advisory |
| https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42121 | Vendor Advisory |
| http://liferay.com | Vendor Advisory |
| https://issues.liferay.com/browse/LPE-17414 | Issue Tracking Vendor Advisory |
| https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42121 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
History
13 May 2025, 18:17
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Liferay digital Experience Platform
|
|
| CPE | cpe:2.3:a:liferay:dxp:7.2:fix_pack_6:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.1:fix_pack_9:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.2:fix_pack_15:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.1:fix_pack_18:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.1:fix_pack_1:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.1:fix_pack_12:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.2:fix_pack_9:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.2:fix_pack_13:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.1:fix_pack_11:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.2:-:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.2:fix_pack_14:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.1:fix_pack_8:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.1:fix_pack_15:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.1:fix_pack_22:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.1:fix_pack_3:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.1:fix_pack_16:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.1:fix_pack_23:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.1:fix_pack_19:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.2:fix_pack_11:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.2:fix_pack_8:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.1:fix_pack_5:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.1:-:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.1:fix_pack_24:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.1:fix_pack_4:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.1:fix_pack_20:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.2:fix_pack_12:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.1:fix_pack_6:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.2:fix_pack_5:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.1:fix_pack_7:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.2:fix_pack_2:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.2:fix_pack_1:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.1:fix_pack_14:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.2:fix_pack_10:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.2:fix_pack_4:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.1:fix_pack_2:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.1:fix_pack_10:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.1:fix_pack_17:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.1:fix_pack_21:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.1:fix_pack_25:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.2:fix_pack_7:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.2:fix_pack_3:*:*:*:*:*:* |
cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_13:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_15:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_5:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_16:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.1:-:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_14:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_12:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_3:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_4:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_8:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_11:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_2:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_23:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_10:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_21:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_14:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_4:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_9:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_8:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_6:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.2:-:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_3:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_5:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_7:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_22:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_6:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_19:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_20:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_11:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_13:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_15:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_24:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_2:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_12:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_17:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_7:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_1:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_9:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_1:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_10:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_25:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_18:*:*:*:*:*:* |
21 Nov 2024, 07:24
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-11-15 01:15
Updated : 2025-05-13 18:17
NVD link : CVE-2022-42121
Mitre link : CVE-2022-42121
CVE.ORG link : CVE-2022-42121
JSON object : View
Products Affected
liferay
- liferay_portal
- dxp
- digital_experience_platform
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')