CVE-2022-42121: 
Java vulnerability analysis and mitigation

A SQL injection vulnerability was identified in the Layout module of Liferay Portal versions 7.1.3 through 7.4.3.4, and Liferay DXP versions 7.1 before fix pack 27, 7.2 before fix pack 17, 7.3 before service pack 3, and 7.4 GA. The vulnerability was discovered and assigned CVE-2022-42121, with the initial record created on October 3, 2022 (CVE Mitre).

The vulnerability exists in the Layout module's page template upgrade process, where remote authenticated attackers can execute arbitrary SQL commands by injecting a crafted payload into a page template's 'Name' field. The vulnerability has been assigned a CVSS v3.1 score of 6.4 (CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H), indicating moderate severity (Liferay Security).

If successfully exploited, this vulnerability allows attackers with authenticated access to execute arbitrary SQL commands on the affected system, potentially compromising the confidentiality, integrity, and availability of the database (Liferay Security).

The vulnerability requires an authenticated user with access to page template functionality. The attack complexity is considered high, and user interaction is required for successful exploitation, as indicated by the CVSS metrics (Liferay Security).

For Liferay Portal users, version 7.4.3.5 contains the fix for this vulnerability. There are no fixes available for Liferay Portal versions 7.1, 7.2, and 7.3, and users are advised to upgrade to Liferay Portal 7.4 (Liferay Security).