CVE-2023-3426
02.08.2023, 10:15
The organization selector in Liferay Portal 7.4.3.81 through 7.4.3.85, and Liferay DXP 7.4 update 81 through 85 does not check user permission, which allows remote authenticated users to obtain a list of all organizations.
| Vendor | Product | Version |
|---|---|---|
| liferay | digital_experience_platform | 7.4:update81 |
| liferay | digital_experience_platform | 7.4:update82 |
| liferay | digital_experience_platform | 7.4:update83 |
| liferay | digital_experience_platform | 7.4:update84 |
| liferay | digital_experience_platform | 7.4:update85 |
| liferay | liferay_portal | 7.4.3.81 ≤ 𝑥 ≤ 7.4.3.85 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-425 - Direct Request ('Forced Browsing')The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.
- CWE-862 - Missing AuthorizationThe software does not perform an authorization check when an actor attempts to access a resource or perform an action.