GHSA-642h-mx8q-47p2

ghsaUSosv

Missing permissions check in Liferay Portal

view advisory published 2022-11-15Licence: CC-BY-4.0

The Asset Libraries module in Liferay Portal 7.3.5 through 7.4.3.28, and Liferay DXP 7.3 before update 8, and DXP 7.4 before update 29 does not properly check permissions of asset libraries, which allows remote authenticated users to view asset libraries via the UI.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2022-42126US	medium4.3	0.69% (53rd)	—	2022-11-15
The Asset Libraries module in Liferay Portal 7.3.5 through 7.4.3.28, and Liferay DXP 7.3 before update 8, and DXP 7.4 before update 29 does not properly check permissions of asset…

references

External citations — patches, advisories, analysis.

http://liferay.comWEB
https://issues.liferay.com/browse/LPE-17593WEB
https://nvd.nist.gov/vuln/detail/CVE-2022-42126ADVISORY
https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42126WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan