GitHub Advisoryadvisory · Maven

GHSA-xph3-vjcq-g488 Liferay Portal and Liferay DXP Organization Selector Does Not Check User Permissions

MEDIUM Published 2023-08-02 Modified 2025-08-08 Official page ↗
Aliases
CVE-2023-3426
Ecosystem
Maven
Packages
com.liferay:com.liferay.organizations.item.selector.web, com.liferay.portal:release.dxp.bom
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-425, CWE-862
Reviewed
2025-08-08

Affected packages

• Maven com.liferay:com.liferay.organizations.item.selector.web: < 4.0.14 → fixed in 4.0.14 • Maven com.liferay.portal:release.dxp.bom: >= 7.4.143.u81, <= 7.4.143.u85 (no fix yet)

Description

The organization selector before 4.0.14 from Liferay Portal (7.4.3.81 through 7.4.3.85), and Liferay DXP 7.4 update 81 through 85 does not check user permission, which allows remote authenticated users to obtain a list of all organizations.

Related

Alias · CVE (1)

  • CVE-2023-3426 The organization selector in Liferay Portal 7.4.3.81 through 7.4.3.85, and Liferay DXP 7.4 update 81 through 85 does not check user… vulnerability

Weakness · CWE (2)

  • CWE-425 Direct Request weakness
  • CWE-862 Missing Authorization weakness

References