Description

The Asset Libraries module in Liferay Portal 7.3.5 through 7.4.3.28, and Liferay DXP 7.3 before update 8, and DXP 7.4 before update 29 does not properly check permissions of asset libraries, which allows remote authenticated users to view asset libraries via the UI.

Remediation

References

https://issues.liferay.com/browse/LPE-17593

https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42126

Related Vulnerabilities

CVE-2020-5407 Vulnerability in maven package org.springframework.security:spring-security-saml2-service-provider

CVE-2019-10381 Vulnerability in maven package org.jenkins-ci.plugins:codefresh

CVE-2017-1000403 Vulnerability in maven package org.jvnet.hudson.plugins:speaks

CVE-2020-6462 Vulnerability in maven package org.webjars.npm:electron

CVE-2018-11537 Vulnerability in maven package org.webjars.bower:angular-jwt

Severity

Medium

Classification

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Tags

Vendor Advisory NVD-CWE-noinfo