Skip to content
OpenAdvisories
High · 7.5 CVE-2022-28981 EUVD-2022-33412GHSA-5j86-vmpx-42pc

Liferay Portal Path Traversal Vulnerability via the Hypermedia REST APIs Module

Published Sep 22, 2022 · Updated Jul 9, 2026 · Assigned by mitre

Package: com.liferay:com.liferay.headless.discovery.web Ecosystem: Maven

Description

Path traversal vulnerability in the Hypermedia REST APIs module in Liferay Portal 7.4.0 through 7.4.2 allows remote attackers to access files outside of com.liferay.headless.discovery.web/META-INF/resources via the `parameter` parameter.

Affected packages

EcosystemPackageAffectedFixedRecord
Maven com.liferay:com.liferay.headless.discovery.web < 4.0.12 4.0.12 GHSA-5j86-vmpx-42pc

References