GitHub Advisoryadvisory · Maven

GHSA-83qx-288m-72w4 Liferay Portal Missing Authorization vulnerability

MEDIUM Published 2022-09-23 Modified 2022-09-23 Official page ↗
Aliases
CVE-2022-39975
Ecosystem
Maven
Packages
com.liferay.portal:release.portal.bom
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-862
Reviewed
2022-09-23

Affected packages

• Maven com.liferay.portal:release.portal.bom: >= 7.3.3, < 7.4.3.35 → fixed in 7.4.3.35

Description

The Layout module in Liferay Portal v7.3.3 through v7.4.3.34, and Liferay DXP 7.3 before update 10, and 7.4 before update 35 does not check user permission before showing the preview of a "Content Page" type page, allowing attackers to view unpublished "Content Page" pages via URL manipulation.

Related

Alias · CVE (1)

  • CVE-2022-39975 The Layout module in Liferay Portal v7.3.3 through v7.4.3.34, and Liferay DXP 7.3 before update 10, and 7.4 before update 35 does not check… vulnerability

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References