Maven/com.liferay:com.liferay.fragment.service CVE-2022-42120: critical 9.8, EPSS 0.80%

Liferay Portal and Liferay DXP Vulnerable to SQL Injection via the Fragment Module

Action: Upgrade com.liferay:com.liferay.fragment.service to 4.0.33 or later.

Affected

Fixed versions

Sources

• osv: GHSA-r5fj-j449-vqw2
• https://nvd.nist.gov/vuln/detail/CVE-2022-42120
• https://github.com/liferay/liferay-portal/commit/6f94d203f5a194a64055e1e0ba0224d26ec54e47
• https://github.com/liferay/liferay-portal
• https://issues.liferay.com/browse/LPE-17513
• https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42120
• https://web.archive.org/web/20220801000000*/https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42120
• http://liferay.com

CVE-2022-42120 · published 2022-11-15T12:00:16Z · modified 2025-09-05T19:56:19.713926Z · JSON