Description

The Liferay JSON implementation do not check if a user that call a method on a serviceClass is disabled. Usually the default administrator user, test@liferay.com, is used to create a new administrator and disabled without to change the default password, so it is possible to use it to execute JSON API calls.

Remediation

Upgrade to the latest version of Liferay.

References

Liferay JSON service API authentication vulnerability

Liferay homepage

Related Vulnerabilities

phpMyFAQ Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2017-15730)

Moodle Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2009-4305)

TeamCity Authentication Bypass (CVE-2024-27199)

Drupal CVE-2020-28949 Vulnerability (CVE-2020-28949)

Joomla Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-13761)

Severity

High

Classification

CWE-287 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Tags

Authentication Bypass Known Vulnerabilities