---
id: CVE-2022-42118
title: >-
  A Cross-site scripting (XSS) vulnerability in the Portal Search module in
  Liferay Portal 7.1.0 through 7.4.2, and Liferay DXP 7.1 before fix pack 27,
  7.2 before fix pack 15, and 7.3 before service pack 3 allows remote attackers
  to inject…
summary: >-
  A Cross-site scripting (XSS) vulnerability in the Portal Search module in
  Liferay Portal 7.1.0 through 7.4.2, and Liferay DXP 7.1 before fix pack 27,
  7.2 before fix pack 15, and 7.3 before service pack 3 allows remote attackers
  to inject…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
cwe:
  - CWE-79
  - CWE-79
vendor: liferay
product: liferay_portal
affected:
  - 'liferay_portal >= 7.1.0, <= 7.4.2'
  - digital_experience_platform = 7.1
  - digital_experience_platform = 7.2
  - dxp = 7.3
published: '2022-11-15'
updated: '2026-07-04'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2022-42118'
references:
  - url: 'https://issues.liferay.com/browse/LPE-17342'
    label: cve@mitre.org
  - url: >-
      https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42118
    label: cve@mitre.org
  - url: 'http://liferay.com'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://issues.liferay.com/browse/LPE-17342'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42118
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
  - exploit-available
epss: 0.00966
epssPercentile: 0.6014
ingestedAt: '2026-07-04T22:58:05.182Z'
exploits:
  nuclei:
    - CVE-2022-42118
  checkedAt: '2026-09-26T09:05:28.332Z'
exploitAvailable: true
---

## Overview

A Cross-site scripting (XSS) vulnerability in the Portal Search module in Liferay Portal 7.1.0 through 7.4.2, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 15, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the `tag` parameter.

## Affected

- `liferay_portal >= 7.1.0, <= 7.4.2`
- `digital_experience_platform = 7.1`
- `digital_experience_platform = 7.2`
- `dxp = 7.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.