CVE-2022-42122

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-11-15 · updated 2026-07-09
Weakness: CWE-89

Description

A SQL injection vulnerability in the Friendly Url module in Liferay Portal 7.3.7, and Liferay DXP 7.3 fix pack 2 through update 4 allows attackers to execute arbitrary SQL commands via a crafted payload injected into the `title` field of a friendly URL.

Affected products

Liferay DXP: 7.3-fix_pack_2
Liferay Portal: 7.3.7

References

https://issues.liferay.com/browse/LPE-17520
https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42122
https://issues.liferay.com/browse/LPE-17520
https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42122

Get alerted when CVE-2022-42122 or the next vulnerability affects your stack