{"id":"GHSA-wjfm-qxg2-q679","summary":"Liferay Portal and Liferay DXP Vulnerable to XSS via the Commerce Module","details":"Certain Liferay products are vulnerable to Cross Site Scripting (XSS) via the Commerce module. This affects the Commerce module before 4.0.8 from Liferay Portal (7.3.5 through 7.4.2) and Liferay DXP 7.3 before update 8.","aliases":["CVE-2022-42119"],"modified":"2025-08-08T21:44:55.597892Z","published":"2022-11-15T12:00:16Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2025-08-08T21:11:36Z","nvd_published_at":"2022-11-15T01:15:00Z","cwe_ids":["CWE-79"],"severity":"MODERATE"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-42119"},{"type":"WEB","url":"https://github.com/liferay/liferay-portal/commit/2e02110747dd5cccb978623545bfa1f3ad0a5602"},{"type":"PACKAGE","url":"https://github.com/liferay/liferay-portal"},{"type":"WEB","url":"https://issues.liferay.com/browse/LPE-17632"},{"type":"WEB","url":"https://web.archive.org/web/20221115040019/https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42119"},{"type":"WEB","url":"http://liferay.com"}],"affected":[{"package":{"name":"com.liferay.commerce:com.liferay.commerce.catalog.web","ecosystem":"Maven","purl":"pkg:maven/com.liferay.commerce/com.liferay.commerce.catalog.web"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.8"}]}],"versions":["1.0.0","1.0.1","1.0.10","1.0.11","1.0.12","1.0.13","1.0.14","1.0.15","1.0.16","1.0.17","1.0.18","1.0.19","1.0.2","1.0.20","1.0.21","1.0.22","1.0.23","1.0.24","1.0.25","1.0.26","1.0.27","1.0.28","1.0.29","1.0.3","1.0.30","1.0.31","1.0.32","1.0.33","1.0.34","1.0.35","1.0.36","1.0.37","1.0.38","1.0.39","1.0.4","1.0.40","1.0.41","1.0.42","1.0.43","1.0.44","1.0.45","1.0.5","1.0.6","1.0.7","1.0.8","1.0.9","2.0.0","2.0.1","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","3.0.0","3.0.1","3.0.10","3.0.11","3.0.12","3.0.13","3.0.14","3.0.15","3.0.16","3.0.17","3.0.18","3.0.19","3.0.2","3.0.20","3.0.21","3.0.22","3.0.23","3.0.24","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","3.0.9","4.0.0","4.0.1","4.0.2","4.0.3","4.0.4","4.0.5","4.0.6","4.0.7"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/11/GHSA-wjfm-qxg2-q679/GHSA-wjfm-qxg2-q679.json"}},{"package":{"name":"com.liferay.portal:release.dxp.bom","ecosystem":"Maven","purl":"pkg:maven/com.liferay.portal/release.dxp.bom"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.3.0"},{"fixed":"7.3.10.u8"}]}],"versions":["7.3.10","7.3.10.ep3","7.3.10.ep4","7.3.10.ep5","7.3.10.fp1","7.3.10.fp2","7.3.10.u4","7.3.10.u5","7.3.10.u6","7.3.10.u7"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/11/GHSA-wjfm-qxg2-q679/GHSA-wjfm-qxg2-q679.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"}]}