CVE-2022-42119: 
Java vulnerability analysis and mitigation

Cross-site scripting (XSS) vulnerability was identified in Liferay Portal's Commerce module, specifically affecting versions 7.3.5 through 7.4.2. The vulnerability was assigned identifier CVE-2022-42119 and was discovered by Duy Huynh, with publication date of October 19, 2022 (Liferay Security).

The vulnerability exists in the Commerce module's edit catalog page, where remote attackers can inject arbitrary web script or HTML through the '_com_liferay_commerce_catalog_web_internal_portlet_CommerceCatalogsPortlet_externalReferenceCode' parameter. The vulnerability has been assigned a CVSS v3.1 score of 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) (Liferay Security).

The vulnerability allows attackers to perform cross-site scripting attacks, potentially leading to the injection of malicious web scripts or HTML content in the context of the affected Commerce module. This could result in compromised user sessions and unauthorized access to sensitive information (Liferay Security).

For Liferay Portal 7.4.x users, the vulnerability has been fixed in version 7.4.3.4. Users of Liferay Portal 7.3.x are advised to upgrade to Liferay Portal 7.4 as there is no fix available for the 7.3 version line (Liferay Security).