CVE-2022-42120: 
Java vulnerability analysis and mitigation

A SQL injection vulnerability was identified in the Fragment module of Liferay Portal versions 7.3.3 through 7.4.3.16, and Liferay DXP 7.3 before update 4, and 7.4 before update 17. The vulnerability allows attackers to execute arbitrary SQL commands through manipulation of a PortletPreferences' namespace attribute (CVE Mitre, Liferay Security).

The vulnerability exists in the Fragment module's PortletPreferences upgrade process and has been assigned a CVSS v3.1 score of 6.4 (CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H). This indicates that while the vulnerability requires high privileges and user interaction, it can potentially lead to significant impact on confidentiality, integrity, and availability of the system (Liferay Security).

If successfully exploited, the vulnerability allows attackers to execute arbitrary SQL commands, potentially leading to unauthorized access to the database, data manipulation, and compromise of the system's integrity (CVE Mitre).

The vulnerability requires high privileges and user interaction for successful exploitation, as indicated by the CVSS metrics. The attack complexity is considered high, suggesting that specific conditions need to be met for successful exploitation (Liferay Security).

For Liferay Portal 7.4 users, the vulnerability has been fixed in version 7.4.3.17. For users running Liferay Portal 7.3, there is no direct fix available, and it is recommended to upgrade to Liferay Portal 7.4 (Liferay Security).