Improper User Permission Check in Liferay Portal and DXP
CVE-2022-42127

5.3MEDIUM

Key Information:

Vendor

Liferay
Status
Digital Experience Platform
Liferay Portal
Vendor
CVE Published:
15 November 2022

What is CVE-2022-42127?

A flaw in the Friendly Url module within Liferay Portal versions 7.4.3.5 to 7.4.3.36 and Liferay DXP updates 1 through 36 allows remote attackers to bypass permission checks. This vulnerability can lead to unauthorized retrieval of all friendly URLs assigned to a page, potentially exposing critical information to malicious users. Organizations using these versions are advised to apply relevant security patches promptly to mitigate the risk.

References

http://liferay.com
https://portal.liferay.dev/learn/security/known-vulnerabi...
https://issues.liferay.com/browse/LPE-17607

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.