GHSA-hffx-r282-w2g9

ghsaUSosv

Path Traversal in Liferay Portal

view advisory published 2022-11-15Licence: CC-BY-4.0

A Zip slip vulnerability in the Elasticsearch Connector in Liferay Portal 7.3.3 through 7.4.3.18, and Liferay DXP 7.3 before update 6, and 7.4 before update 19 allows attackers to create or overwrite existing files on the filesystem via the installation of a malicious Elasticsearch Sidecar plugin.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2022-42123US	high7.5	0.78% (56th)	—	2022-11-15
A Zip slip vulnerability in the Elasticsearch Connector in Liferay Portal 7.3.3 through 7.4.3.18, and Liferay DXP 7.3 before update 6, and 7.4 before update 19 allows attackers to…

references

External citations — patches, advisories, analysis.

http://liferay.comWEB
https://issues.liferay.com/browse/LPE-17518WEB
https://nvd.nist.gov/vuln/detail/CVE-2022-42123ADVISORY
https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42123WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan