What is GHSA-wjfm-qxg2-q679?

GHSA-wjfm-qxg2-q679 is a security advisory published by GitHub Security Advisories with Medium severity. Liferay Portal and Liferay DXP Vulnerable to XSS via the Commerce Module

Which CVE IDs does GHSA-wjfm-qxg2-q679 cover?

GHSA-wjfm-qxg2-q679 covers the following CVE IDs: CVE-2022-42119. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-wjfm-qxg2-q679?

GHSA-wjfm-qxg2-q679 has a CVSS v3 base score of 5.4, published by GitHub Security Advisories.

Which products are affected by GHSA-wjfm-qxg2-q679?

GHSA-wjfm-qxg2-q679 affects 2 products, including: maven/com.liferay.commerce:com.liferay.commerce.catalog.web:\u003c 4.0.8; maven/com.liferay.portal:release.dxp.bom:\u003e= 7.3.0, \u003c 7.3.10.u8.

GHSA-wjfm-qxg2-q679MediumCVSS 5.4

Liferay Portal and Liferay DXP Vulnerable to XSS via the Commerce Module

Vendor

GitHub Security Advisories

Published

November 15, 2022

Last Modified

August 8, 2025

🔗 CVE IDs covered (1)

CVE-2022-42119 →

📋 Description

Certain Liferay products are vulnerable to Cross Site Scripting (XSS) via the Commerce module. This affects the Commerce module before 4.0.8 from Liferay Portal (7.3.5 through 7.4.2) and Liferay DXP 7.3 before update 8.

🎯 Affected products2

maven/com.liferay.commerce:com.liferay.commerce.catalog.web:< 4.0.8
maven/com.liferay.portal:release.dxp.bom:>= 7.3.0, < 7.3.10.u8

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2022-42119
https://issues.liferay.com/browse/LPE-17632
http://liferay.com
https://github.com/liferay/liferay-portal/commit/2e02110747dd5cccb978623545bfa1f3ad0a5602
https://web.archive.org/web/20221115040019/https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42119
https://github.com/advisories/GHSA-wjfm-qxg2-q679