Design/Logic Flaw

2023-05-2416:15:00

PRIOn knowledge base

www.prio-n.com

design/logic flaw

object module

liferay portal

remote authenticated users

virtual instances

oauth 2

4.4 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

30.0%

JSON

The Object module in Liferay Portal 7.4.3.4 through 7.4.3.48, and Liferay DXP 7.4 before update 49 does properly isolate objects in difference virtual instances, which allows remote authenticated users in one virtual instance to view objects in a different virtual instance via OAuth 2 scope administration page.

CPENameOperatorVersion
digital_experience_platformeq7.4 update34
digital_experience_platformeq7.4 update1
digital_experience_platformeq7.4
digital_experience_platformeq7.4 update36
liferay_portalge7.4.3.4
liferay_portalle7.4.3.48

Name	Operator	Version
digital_experience_platform	eq	7.4 update34
digital_experience_platform	eq	7.4 update1
digital_experience_platform	eq	7.4
digital_experience_platform	eq	7.4 update36
liferay_portal	ge	7.4.3.4
liferay_portal	le	7.4.3.48