CVE-2022-28981
Last modified
CVE-2022-28981 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. Path traversal vulnerability in the Hypermedia REST APIs module in Liferay Portal 7.4.0 through 7.4.2 allows remote attackers to access files outside of com.liferay.headless.discovery.web/META-INF/resources via the `parameter` parameter.. EPSS estimates a 1.08% chance of exploitation in the next 30 days.
Description
Path traversal vulnerability in the Hypermedia REST APIs module in Liferay Portal 7.4.0 through 7.4.2 allows remote attackers to access files outside of com.liferay.headless.discovery.web/META-INF/resources via the `parameter` parameter.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Liferay | Liferay Portal | >= 7.4.0, <= 7.4.2 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-28981?
How severe is CVE-2022-28981?
How do I fix CVE-2022-28981?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-28975A stored cross-site scripting (XSS) vulnerability in Infoblo…5.4
- CVE-2022-28977HtmlUtil.escapeRedirect in Liferay Portal 7.3.1 through 7.4.…6.1
- CVE-2022-28978Stored cross-site scripting (XSS) vulnerability in the Site …5.4
- CVE-2022-28979Liferay Portal v7.1.0 through v7.4.2 and Liferay DXP 7.1 bef…6.1
- CVE-2022-2898Measuresoft ScadaPro Server and Client (All Versions) do not…5.5
- CVE-2022-28980Multiple cross-site scripting (XSS) vulnerabilities in Lifer…6.1
- CVE-2022-28982A cross-site scripting (XSS) vulnerability in Liferay Portal…6.1
- CVE-2022-28985A stored cross-site scripting (XSS) vulnerability in the add…5.4
- CVE-2022-28986LMS Doctor Simple 2 Factor Authentication Plugin For Moodle …7.5
- CVE-2022-28987Zoho ManageEngine ADSelfService Plus before 6202 allows atta…5.3
- CVE-2022-28990WASM3 v0.5.0 was discovered to contain a heap overflow via t…7.8
- CVE-2022-28991Multi Store Inventory Management System v1.0 was discovered …7.5
Are you affected by CVE-2022-28981?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST