CVE-2022-26595GHSA-822F-JFPG-HG7HBIT-LIFERAY-2022-26595
Liferay Portal 7.3.7, 7.4.0, and 7.4.1, and Liferay DXP 7.2 fix pack 13, and 7.3 fix pack 2 does not properly check user permission when acc
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 7.4.2-ga3, 7.2.10.fp13, 7.3.10.fp2, 6.0.5, 7.7.9
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Liferay Portal 7.3.7, 7.4.0, and 7.4.1, and Liferay DXP 7.2 fix pack 13, and 7.3 fix pack 2 does not properly check user permission when accessing a list of sites/groups, which allows remote authenticated users to view sites/groups via the user's site membership assignment UI.
Timeline
- CVE published
- Record last updated
Affected versions
- n/a n/a
Version range not reported
- com.liferay.portal:release.portal.bomMaven
7.3.7
- com.liferay.portal:release.portal.bomMaven
From 7.4.0 · fixed in 7.4.2-ga3
- com.liferay.portal:release.dxp.bomMaven
From 7.2.0 · fixed in 7.2.10.fp13
- com.liferay.portal:release.dxp.bomMaven
From 7.3.0 · fixed in 7.3.10.fp2
- com.liferay:com.liferay.site.browser.webMaven
fixed in 6.0.5
- com.liferay.portal:com.liferay.portal.implMaven
fixed in 7.7.9