CVEvulnerability

CVE-2022-39975

4.3 MEDIUM Published 2022-09-22 Modified 2026-07-09 Official page ↗
Status
Modified
Published
2022-09-22
Last modified
2026-07-09
Assigner
[email protected]
CVSS 3.1 ([email protected])
4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-862

Description

The Layout module in Liferay Portal v7.3.3 through v7.4.3.34, and Liferay DXP 7.3 before update 10, and 7.4 before update 35 does not check user permission before showing the preview of a "Content Page" type page, allowing attackers to view unpublished "Content Page" pages via URL manipulation.

Affected configurations

• liferay dxp 7.3 • liferay dxp 7.4 • liferay liferay portal (>= 7.3.3 < 7.4.3.35)

Related

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References