CVE-2022-42111: Liferay Digital Experience Platform

Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days.

A Cross-site scripting (XSS) vulnerability in the Sharing module's user notification in Liferay Portal 7.2.1 through 7.4.2, and Liferay DXP 7.2 before fix pack 19, and 7.3 before update 4 allows remote attackers to inject arbitrary web script or HTML by sharing an asset with a crafted payload.

Affected products

• Liferay Digital Experience Platform: version 7.2 only
• Liferay Dxp: version 7.3 only
• Liferay Liferay Portal: from 7.2.1, up to and including 7.4.2

Published 2022-11-15. Last modified 2026-06-17.