Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS04M3F4LTI4OG0tNzJ3NM4AAvAO

Liferay Portal Missing Authorization vulnerability

The Layout module in Liferay Portal v7.3.3 through v7.4.3.34, and Liferay DXP 7.3 before update 10, and 7.4 before update 35 does not check user permission before showing the preview of a "Content Page" type page, allowing attackers to view unpublished "Content Page" pages via URL manipulation.

Permalink: https://github.com/advisories/GHSA-83qx-288m-72w4
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS04M3F4LTI4OG0tNzJ3NM4AAvAO
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: about 2 years ago
Updated: almost 2 years ago

CVSS Score: 4.3
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Identifiers: GHSA-83qx-288m-72w4, CVE-2022-39975
References:

• https://nvd.nist.gov/vuln/detail/CVE-2022-39975
• https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-39975
• http://liferay.com
• https://github.com/advisories/GHSA-83qx-288m-72w4

Blast Radius: 6.5

Affected Packages