CVE-2022-42114: 
Java vulnerability analysis and mitigation

A Cross-site scripting (XSS) vulnerability was discovered in the Role module's edit role assignees page in Liferay Portal 7.4.0 through 7.4.3.36, and Liferay DXP 7.4 before update 37. The vulnerability allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_roles_admin_web_portlet_RolesAdminPortlet_name parameter (Liferay Security, NVD).

The vulnerability has been assigned a CVSS score of 4.8 (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N). The issue specifically affects the Role module's edit role assignees page functionality, where input validation is insufficient for the _com_liferay_roles_admin_web_portlet_RolesAdminPortlet_name parameter (Liferay Security).

The vulnerability allows attackers to inject arbitrary web script or HTML into the application, potentially leading to cross-site scripting attacks. This could result in the execution of malicious scripts in users' browsers within the context of the affected site (NVD).

The vulnerability requires high privileges and user interaction to be exploited, as indicated by the CVSS metrics (PR:H/UI:R). The attack vector is network-based (AV:N) with low attack complexity (AC:L) (Liferay Security).

The vulnerability has been fixed in Liferay Portal version 7.4.3.37 and Liferay DXP 7.4 update 37. Users are advised to upgrade to these or later versions to address the vulnerability (Liferay Security).