SB2022101936 - Multiple vulnerabilities in Liferay Enterprise Portal

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2022101936

SB2022101936 - Multiple vulnerabilities in Liferay Enterprise Portal

Published: October 19, 2022 Updated: April 7, 2023

Security Bulletin ID SB2022101936
Severity
High
Patch available
YES
Number of vulnerabilities 5
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 20% Medium 60% Low 20%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 5 secuirty vulnerabilities.


1) SQL injection (CVE-ID: CVE-2022-42121)

The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.

The vulnerability exists due to insufficient sanitization of user-supplied data in the Layout module's page template upgrade process within the "Name" field. A remote attacker can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.

Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.


2) Resource exhaustion (CVE-ID: CVE-2022-42124)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources in LayoutPageTemplateEntryUpgradeProcess in the "name" field. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.


3) Information disclosure (CVE-ID: CVE-2022-42128)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to the Hypermedia REST APIs module does not properly check permissions. A remote attacker can obtain a WikiNode object via the WikiNodeResource.getSiteWikiNodeByExternalReferenceCode API.


4) Information disclosure (CVE-ID: CVE-2022-42129)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to an insecure direct object reference (IDOR) issue in the Dynamic Data Mapping module in the "formInstanceRecordId" parameter. A remote user can view and access form entries.


5) Information disclosure (CVE-ID: CVE-2022-42132)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to the Test LDAP Users functionality includes the LDAP credential in the page URL when paginating through the list of users. A remote attacker can obtain LDAP credentials from the URL.


Remediation

Install update from vendor's website.

References