GitHub Advisoryadvisory · Maven

GHSA-wgqm-qp44-cg6x Incorrect Default Permissions in Liferay Portal

MEDIUM Published 2022-11-15 Modified 2022-11-21 Official page ↗
Aliases
CVE-2022-42128
Ecosystem
Maven
Packages
com.liferay.portal:release.portal.bom
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-276
Reviewed
2022-11-21

Affected packages

• Maven com.liferay.portal:release.portal.bom: >= 7.4.1, < 7.4.3.5 → fixed in 7.4.3.5

Description

The Hypermedia REST APIs module in Liferay Portal 7.4.1 through 7.4.3.4, and Liferay DXP 7.4 GA does not properly check permissions, which allows remote attackers to obtain a WikiNode object via the WikiNodeResource.getSiteWikiNodeByExternalReferenceCode API.

Related

Alias · CVE (1)

  • CVE-2022-42128 The Hypermedia REST APIs module in Liferay Portal 7.4.1 through 7.4.3.4, and Liferay DXP 7.4 GA does not properly check permissions, which… vulnerability

Weakness · CWE (1)

  • CWE-276 Incorrect Default Permissions weakness

References