CVE-2022-28981: 
Java vulnerability analysis and mitigation

Path traversal vulnerability (CVE-2022-28981) affects the Hypermedia REST APIs module in Liferay Portal versions 7.4.0 through 7.4.2. The vulnerability was disclosed on January 24, 2022, and allows remote attackers to access files outside of com.liferay.headless.discovery.web/META-INF/resources directory (Liferay Portal).

The vulnerability exists in the Hypermedia REST APIs module and can be exploited via the 'parameter' parameter. The severity of this vulnerability is rated as 8.6 (High) under CVSS v3.1 scoring system with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N. This indicates that the vulnerability is network exploitable, requires low attack complexity, needs no privileges or user interaction, and can result in high confidentiality impact (Liferay Portal).

The vulnerability allows remote attackers to access files that should be restricted, potentially exposing sensitive information stored outside of the intended directory structure. The CVSS score indicates high confidentiality impact, meaning unauthorized access to sensitive data is possible (Liferay Portal).

The vulnerability can be exploited remotely without requiring any authentication or user interaction. The attack complexity is rated as low, indicating that the vulnerability is relatively straightforward to exploit using the 'parameter' parameter (Liferay Portal).

The vulnerability has been fixed in Liferay Portal 7.4 GA4 (7.4.3.4). Users running affected versions (7.4.0 through 7.4.2) should upgrade to the fixed version to mitigate this security risk (Liferay Portal).