GitHub Advisoryadvisory · Maven

GHSA-642h-mx8q-47p2 Missing permissions check in Liferay Portal

MEDIUM Published 2022-11-15 Modified 2022-11-21 Official page ↗
Aliases
CVE-2022-42126
Ecosystem
Maven
Packages
com.liferay.portal:release.portal.bom
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-280, CWE-284
Reviewed
2022-11-21

Affected packages

• Maven com.liferay.portal:release.portal.bom: >= 7.3.5, < 7.4.3.48 → fixed in 7.4.3.48

Description

The Asset Libraries module in Liferay Portal 7.3.5 through 7.4.3.28, and Liferay DXP 7.3 before update 8, and DXP 7.4 before update 29 does not properly check permissions of asset libraries, which allows remote authenticated users to view asset libraries via the UI.

Related

Alias · CVE (1)

  • CVE-2022-42126 The Asset Libraries module in Liferay Portal 7.3.5 through 7.4.3.28, and Liferay DXP 7.3 before update 8, and DXP 7.4 before update 29 does… vulnerability

Weakness · CWE (2)

  • CWE-280 Improper Handling of Insufficient Permissions or Privileges weakness
  • CWE-284 Improper Access Control weakness

References