GHSA-g8hp-rc67-jf96, CVE-2022-42125
maven/com.liferay.portal/release.portal.bom
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Zip slip vulnerability in FileUtil.unzip in Liferay Portal 7.4.3.5 through 7.4.3.35 and Liferay DXP 7.4 update 1 through update 34 allows attackers to create or overwrite existing files on the filesystem via the deployment of a malicious plugin/module.
All versions starting from 7.4.3.5 up to 7.4.3.35
Upgrade to version 7.4.3.48 or above.
2022-11-22
source |