Publish Advisories

advisory-database[bot] · advisory-database[bot] · commit abfe91b6c7a6 · 2025-07-16T19:25:23.000Z
GHSA-g6r2-6x46-jpp6 GHSA-h4c9-rr5m-32fm GHSA-g6r2-6x46-jpp6
diff --git a/advisories/github-reviewed/2022/10/GHSA-g6r2-6x46-jpp6/GHSA-g6r2-6x46-jpp6.json b/advisories/github-reviewed/2022/10/GHSA-g6r2-6x46-jpp6/GHSA-g6r2-6x46-jpp6.json
@@ -0,0 +1,115 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-g6r2-6x46-jpp6",
+  "modified": "2025-07-16T19:22:16Z",
+  "published": "2022-10-19T12:00:23Z",
+  "aliases": [
+    "CVE-2022-42117"
+  ],
+  "summary": "Liferay Portal and Liferay DXP Vulnerable to XSS in the Frontend Taglib Module",
+  "details": "A Cross-site scripting (XSS) vulnerability in the Frontend Taglib module before 9.1.7 from Liferay Portal (7.3.2 through 7.4.3.16), and Liferay DXP 7.3 before update 6, and 7.4 before update 17 allows remote attackers to inject arbitrary web script or HTML.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "com.liferay:com.liferay.frontend.taglib.clay"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "9.1.7"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "com.liferay.portal:release.dxp.bom"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "7.3.0"
+            },
+            {
+              "fixed": "7.3.10.u6"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "com.liferay.portal:release.dxp.bom"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "7.4.0"
+            },
+            {
+              "fixed": "7.4.13.u17"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42117"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/liferay/liferay-portal/commit/a0d25a757f002c39d02b93938bc11feb3b0de6f6"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/liferay/liferay-portal"
+    },
+    {
+      "type": "WEB",
+      "url": "https://liferay.atlassian.net/browse/LPE-17497"
+    },
+    {
+      "type": "WEB",
+      "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2022-42117?p_r_p_assetEntryId=121613244&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121613244%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse"
+    },
+    {
+      "type": "WEB",
+      "url": "https://web.archive.org/web/20221205223431/https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42117"
+    },
+    {
+      "type": "WEB",
+      "url": "http://liferay.com"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-07-16T19:22:16Z",
+    "nvd_published_at": "2022-10-18T21:15:00Z"
+  }
+}
diff --git a/advisories/github-reviewed/2023/04/GHSA-h4c9-rr5m-32fm/GHSA-h4c9-rr5m-32fm.json b/advisories/github-reviewed/2023/04/GHSA-h4c9-rr5m-32fm/GHSA-h4c9-rr5m-32fm.json
@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-h4c9-rr5m-32fm",
-  "modified": "2023-04-07T21:01:39Z",
+  "modified": "2025-07-16T19:24:22Z",
   "published": "2023-04-02T03:30:16Z",
   "aliases": [
     "CVE-2023-27025"
@@ -28,7 +28,7 @@
               "introduced": "0"
             },
             {
-              "fixed": "4.7.6"
+              "fixed": "4.7.7"
             }
           ]
         }
diff --git a/advisories/unreviewed/2022/10/GHSA-g6r2-6x46-jpp6/GHSA-g6r2-6x46-jpp6.json b/advisories/unreviewed/2022/10/GHSA-g6r2-6x46-jpp6/GHSA-g6r2-6x46-jpp6.json

Original file line number	Diff line number	Diff line change
`@@ -1,7 +1,7 @@`
`1`	`1`	`{`
`2`	`2`	`"schema_version": "1.4.0",`
`3`	`3`	`"id": "GHSA-h4c9-rr5m-32fm",`
`4`		`- "modified": "2023-04-07T21:01:39Z",`
	`4`	`+ "modified": "2025-07-16T19:24:22Z",`
`5`	`5`	`"published": "2023-04-02T03:30:16Z",`
`6`	`6`	`"aliases": [`
`7`	`7`	`"CVE-2023-27025"`
`@@ -28,7 +28,7 @@`
`28`	`28`	`"introduced": "0"`
`29`	`29`	`},`
`30`	`30`	`{`
`31`		`- "fixed": "4.7.6"`
	`31`	`+ "fixed": "4.7.7"`
`32`	`32`	`}`
`33`	`33`	`]`
`34`	`34`	`}`