GHSA-83qx-288m-72w4

ghsaUSosv

Liferay Portal Missing Authorization vulnerability

view advisory published 2022-09-23Licence: CC-BY-4.0

The Layout module in Liferay Portal v7.3.3 through v7.4.3.34, and Liferay DXP 7.3 before update 10, and 7.4 before update 35 does not check user permission before showing the preview of a "Content Page" type page, allowing attackers to view unpublished "Content Page" pages via URL manipulation.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2022-39975US	medium4.3OT elevated	0.56% (46th)	—	2022-09-22
The Layout module in Liferay Portal v7.3.3 through v7.4.3.34, and Liferay DXP 7.3 before update 10, and 7.4 before update 35 does not check user permission before showing the previ…

references

External citations — patches, advisories, analysis.

http://liferay.comWEB
https://github.com/liferay/liferay-portalPACKAGE
https://nvd.nist.gov/vuln/detail/CVE-2022-39975ADVISORY
https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-39975WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan