CVE-2022-42125

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in maven/com.liferay.portal/release.portal.bom

Identifiers

GHSA-g8hp-rc67-jf96, CVE-2022-42125

Package Slug

maven/com.liferay.portal/release.portal.bom

Vulnerability

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Description

Zip slip vulnerability in FileUtil.unzip in Liferay Portal 7.4.3.5 through 7.4.3.35 and Liferay DXP 7.4 update 1 through update 34 allows attackers to create or overwrite existing files on the filesystem via the deployment of a malicious plugin/module.

Affected Versions

All versions starting from 7.4.3.5 up to 7.4.3.35

Solution

Upgrade to version 7.4.3.48 or above.

Last Modified

2022-11-22

source