CVE-2024-25604
published 2024-02-20CVE-2024-25604: Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before service pack 3, 7.2 before fix pack 17, and older…
PriorityP336medium6.5CVSS 3.1
AVNACLPRLUINSUCNIHAN
EPSS
0.41%
34.0th percentile
Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions does not properly check user permissions, which allows remote authenticated users with the VIEW user permission to edit their own permission via the User and Organizations section of the Control Panel.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| liferay | digital_experience_platform | < 7.2 | 7.2 |
| liferay | digital_experience_platform | — | — |
| liferay | digital_experience_platform | — | — |
| liferay | digital_experience_platform | — | — |
| liferay | dxp | — | — |
| liferay | dxp | 7.2.10 – 7.2.10-dxp-16 | — |
| liferay | dxp | 7.3.10 – 7.3.10-dxp-2 | — |
| liferay | liferay_portal | < 7.4.3.5 | 7.4.3.5 |
| liferay | portal | 7.2.0 – 7.4.3.4 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Liferay Portal and Liferay DXP Allows Authenticated Users with View Permissions to Edit Permissions
osv·2024-02-20
CVE-2024-25604 [MEDIUM] Liferay Portal and Liferay DXP Allows Authenticated Users with View Permissions to Edit Permissions
Liferay Portal and Liferay DXP Allows Authenticated Users with View Permissions to Edit Permissions
Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions does not properly check user permissions, which allows remote authenticated users with the VIEW user permission to edit their own permission via the User and Organizations section of the Control Panel.
GHSA
Liferay Portal and Liferay DXP Allows Authenticated Users with View Permissions to Edit Permissions
ghsa·2024-02-20
CVE-2024-25604 [MEDIUM] CWE-863 Liferay Portal and Liferay DXP Allows Authenticated Users with View Permissions to Edit Permissions
Liferay Portal and Liferay DXP Allows Authenticated Users with View Permissions to Edit Permissions
Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions does not properly check user permissions, which allows remote authenticated users with the VIEW user permission to edit their own permission via the User and Organizations section of the Control Panel.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-02-20
Published