CVE-2022-42127

published 2022-11-15

CVE-2022-42127: The Friendly Url module in Liferay Portal 7.4.3.5 through 7.4.3.36, and Liferay DXP 7.4 update 1 though 36 does not properly check user permissions, which…

medium 5.3 CVSS 3.1

AV N AC L PR N UI N S U C L I N A N

The Friendly Url module in Liferay Portal 7.4.3.5 through 7.4.3.36, and Liferay DXP 7.4 update 1 though 36 does not properly check user permissions, which allows remote attackers to obtain the history of all friendly URLs that was assigned to a page.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
liferay	digital_experience_platform	—	—
liferay	liferay_portal	>= 7.4.3.5 < 7.4.3.37	7.4.3.37

CWE-276