CVE-2022-28981

—

CVSS 3.1

7.5 high

EPSS

1%p64

Published

Sep 22, 2022 (Sep 22, 2022)

Modified

Jul 9, 2026

Description

Path traversal vulnerability in the Hypermedia REST APIs module in Liferay Portal 7.4.0 through 7.4.2 allows remote attackers to access files outside of com.liferay.headless.discovery.web/META-INF/resources via the `parameter` parameter.

Vendors: liferay
Products: liferay portal
Weakness: CWE-22
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (1.1%)

In the news0 stories

No ingested article mentions this CVE yet.