GitHub Advisoryadvisory · Maven

GHSA-pw7p-3648-qqmg Liferay Portal and Liferay DXP Allows Authenticated Users with View Permissions to Edit Permissions

MEDIUM Published 2024-02-20 Modified 2025-07-29 Official page ↗
Aliases
CVE-2024-25604
Ecosystem
Maven
Packages
com.liferay.portal:release.portal.bom, com.liferay.portal:release.dxp.bom
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-863
Reviewed
2025-07-29

Affected packages

• Maven com.liferay.portal:release.portal.bom: >= 7.2.0, < 7.4.3.5-ga5 → fixed in 7.4.3.5-ga5 • Maven com.liferay.portal:release.dxp.bom: 7.4.13 (no fix yet) • Maven com.liferay.portal:release.dxp.bom: < 7.2.10.fp17 → fixed in 7.2.10.fp17

Description

Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions does not properly check user permissions, which allows remote authenticated users with the VIEW user permission to edit their own permission via the User and Organizations section of the Control Panel.

Related

Alias · CVE (1)

  • CVE-2024-25604 Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before service pack 3, 7.2 before fix… vulnerability

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References