GHSA-xph3-vjcq-g488

ghsaUSosv

Liferay Portal and Liferay DXP Organization Selector Does Not Check User Permissions

view advisory published 2023-08-02Licence: CC-BY-4.0

The organization selector before 4.0.14 from Liferay Portal (7.4.3.81 through 7.4.3.85), and Liferay DXP 7.4 update 81 through 85 does not check user permission, which allows remote authenticated users to obtain a list of all organizations.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2023-3426US	medium4.3OT elevated	0.58% (47th)	—	2023-08-02
The organization selector in Liferay Portal 7.4.3.81 through 7.4.3.85, and Liferay DXP 7.4 update 81 through 85 does not check user permission, which allows remote authenticated us…

references

External citations — patches, advisories, analysis.

https://github.com/liferay/liferay-portalPACKAGE
https://github.com/liferay/liferay-portal/commit/b410f40233394d1d3d1076189befd4b33ba9fb47WEB
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-3426WEB
https://nvd.nist.gov/vuln/detail/CVE-2023-3426ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan