Vulnerability Description
Zip slip vulnerability in FileUtil.unzip in Liferay Portal 7.4.3.5 through 7.4.3.35 and Liferay DXP 7.4 update 1 through update 34 allows attackers to create or overwrite existing files on the filesystem via the deployment of a malicious plugin/module.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Liferay | Digital Experience Platform | 7.4 |
| Liferay | Liferay Portal | >= 7.4.3.5, < 7.4.3.36 |
Related Weaknesses (CWE)
References
- http://liferay.comVendor Advisory
- https://issues.liferay.com/browse/LPE-17517Vendor Advisory
- https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisheVendor Advisory
- http://liferay.comVendor Advisory
- https://issues.liferay.com/browse/LPE-17517Vendor Advisory
- https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisheVendor Advisory
FAQ
What is CVE-2022-42125?
CVE-2022-42125 is a vulnerability with a CVSS score of 7.5 (HIGH). Zip slip vulnerability in FileUtil.unzip in Liferay Portal 7.4.3.5 through 7.4.3.35 and Liferay DXP 7.4 update 1 through update 34 allows attackers to create or overwrite existing files on the filesys...
How severe is CVE-2022-42125?
CVE-2022-42125 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-42125?
Check the references section above for vendor advisories and patch information. Affected products include: Liferay Digital Experience Platform, Liferay Liferay Portal.