CVE-2024-25604 — Incorrect Authorization in Digital Experience Platform

CWE-863 — Incorrect Authorization4 documents4 sources
Severity
6.5MEDIUMNVD
EPSS
0.1%
top 74.69%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Liferay Digital Experience PlatformLiferay PortalLiferay DXP+1 more
Timeline
PublishedFeb 20

Description

Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions does not properly check user permissions, which allows remote authenticated users with the VIEW user permission to edit their own permission via the User and Organizations section of the Control Panel.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages4 packages

▶NVDliferay/liferay_portal< 7.4.3.5
▶CVEListV5liferay/portal7.2.0 — 7.4.3.4
▶CVEListV5liferay/dxp7.3.10 — 7.3.10-dxp-2+2

🔴Vulnerability Details

3
CVEList
CVE-2024-25604: Liferay Portal 7↗2024-02-20
▶
OSV
Liferay Portal and Liferay DXP Allows Authenticated Users with View Permissions to Edit Permissions↗2024-02-20
▶
GHSA
Liferay Portal and Liferay DXP Allows Authenticated Users with View Permissions to Edit Permissions↗2024-02-20
▶
CVE-2024-25604 — Incorrect Authorization | cvebase