CVE-2022-42113: 
Java vulnerability analysis and mitigation

A Cross-site scripting (XSS) vulnerability was discovered in the Document Library module's move file interface in Liferay Portal 7.4.3.30 through 7.4.3.36, and Liferay DXP 7.4 update 30 through update 36. The vulnerability allows remote attackers to inject arbitrary web script or HTML through the 'redirect' parameter (Liferay Portal, CVE Mitre).

The vulnerability has been assigned a CVSS v3.1 score of 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), indicating moderate severity. The attack vector is network-based (AV:N), requires low attack complexity (AC:L), low privileges (PR:L), and user interaction (UI:R). The scope is changed (S:C), with low impacts on confidentiality (C:L) and integrity (I:L), but no impact on availability (A:N) (Liferay Portal).

The vulnerability could allow attackers to execute arbitrary web scripts or inject HTML code in the context of the affected Document Library module. This could potentially lead to theft of sensitive information, session hijacking, or other malicious actions within the user's browser session (CVE Mitre).

The vulnerability has been fixed in Liferay Portal version 7.4.3.37. Users are advised to upgrade to this version or later to mitigate the risk (Liferay Portal).