medium5.3
CVE-2022-42128
Incorrect Default Permissions in Liferay Portal
Impact
The Hypermedia REST APIs module in Liferay Portal 7.4.1 through 7.4.3.4, and Liferay DXP 7.4 GA does not properly check permissions, which allows remote attackers to obtain a WikiNode object via the WikiNodeResource.getSiteWikiNodeByExternalReferenceCode API.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | com.liferay.portal:release.portal.bom | >= 7.4.1, <= 7.4.3.4 | 7.4.3.5 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Liferay | Digital Experience Platform | Version 7.4 |
| Liferay | Liferay Portal | from 7.4.1 before 7.4.3.5 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://issues.liferay.com/browse/LPE-17595
- https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42128
- https://github.com/advisories/GHSA-wgqm-qp44-cg6x
- https://nvd.nist.gov/vuln/detail/CVE-2022-42128
- http://liferay.com