Lucene search

GoogleOSV:GHSA-WGQM-QP44-CG6X

HistoryNov 15, 2022 - 12:00 p.m.

Incorrect Default Permissions in Liferay Portal

2022-11-1512:00:16

Google

osv.dev

liferay portal

default permissions

vulnerability

hypermedia rest apis

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

0.002 Low

EPSS

Percentile

56.5%

JSON

The Hypermedia REST APIs module in Liferay Portal 7.4.1 through 7.4.3.4, and Liferay DXP 7.4 GA does not properly check permissions, which allows remote attackers to obtain a WikiNode object via the WikiNodeResource.getSiteWikiNodeByExternalReferenceCode API.

CPENameOperatorVersion
com.liferay.portal:release.portal.bomeq7.4.2-1
com.liferay.portal:release.portal.bomeq7.4.2
com.liferay.portal:release.portal.bomeq7.4.1
com.liferay.portal:release.portal.bomeq7.4.1-1
com.liferay.portal:release.portal.bomeq7.4.3.4

Name	Operator	Version
com.liferay.portal:release.portal.bom	eq	7.4.2-1
com.liferay.portal:release.portal.bom	eq	7.4.2
com.liferay.portal:release.portal.bom	eq	7.4.1
com.liferay.portal:release.portal.bom	eq	7.4.1-1
com.liferay.portal:release.portal.bom	eq	7.4.3.4

References

liferay.com

issues.liferay.com/browse/LPE-17595

nvd.nist.gov/vuln/detail/CVE-2022-42128

portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42128

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

0.002 Low

EPSS

Percentile

56.5%

JSON

Related for OSV:GHSA-WGQM-QP44-CG6X