CVE-2022-39975 — Missing Authorization in Portal

CWE-862 — Missing Authorization4 documents4 sources
Severity
4.3MEDIUMNVD
EPSS
0.2%
top 63.42%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Liferay PortalLiferay DXP
Timeline
PublishedSep 22
Latest updateSep 23

Description

The Layout module in Liferay Portal v7.3.3 through v7.4.3.34, and Liferay DXP 7.3 before update 10, and 7.4 before update 35 does not check user permission before showing the preview of a "Content Page" type page, allowing attackers to view unpublished "Content Page" pages via URL manipulation.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages2 packages

▶NVDliferay/liferay_portal7.3.3 — 7.4.3.35
▶NVDliferay/dxp7.3, 7.4+1

Patches

Patch: portal.liferay.dev ↗Patch: portal.liferay.dev ↗

🔴Vulnerability Details

3
OSV
Liferay Portal Missing Authorization vulnerability↗2022-09-23
▶
GHSA
Liferay Portal Missing Authorization vulnerability↗2022-09-23
▶
CVEList
CVE-2022-39975: The Layout module in Liferay Portal v7↗2022-09-21
▶
CVE-2022-39975 — Missing Authorization in Portal | cvebase