Insecure Permissions in Liferay Portal and DXP WikiNode API

CVE-2022-42128

What is CVE-2022-42128?

The Hypermedia REST APIs module in Liferay Portal and Liferay DXP has a significant flaw where it fails to properly validate permissions for API calls. This oversight allows remote attackers to exploit the vulnerable WikiNodeResource.getSiteWikiNodeByExternalReferenceCode API, potentially gaining unauthorized access to sensitive WikiNode objects. Attackers leveraging this vulnerability could manipulate the API to retrieve data that should only be accessible to authorized users, posing a serious risk to the integrity of the affected systems.

References