← Back

CVE-2022-42126

nvd nist
Published: Nov 15, 2022Modified: Apr 30, 2025

JSON object

Loading...
4.3
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Exploitability: 2.8 / Impact: 1.4
Source: NVD

Description

The Asset Libraries module in Liferay Portal 7.3.5 through 7.4.3.28, and Liferay DXP 7.3 before update 8, and DXP 7.4 before update 29 does not properly check permissions of asset libraries, which allows remote authenticated users to view asset libraries via the UI.

Affected (4)

Liferay
2 products
Digital Experience Platform
Liferay Portal
Configuration A
4 vulnerable
Vulnerable SoftwareAffected Versions
Liferay
Digital Experience Platform
Version 7.3
Digital Experience Platform
Version 7.4
Digital Experience Platform
Version 7.4 update1
Liferay Portal
From 7.3.5 to 7.4.3.29

Related CWEs

CWE-284
Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

References (6)

Source: cve@mitre.org
Vendor Advisory
Source: cve@mitre.org
Vendor Advisory
Source: cve@mitre.org
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory

Timeline

No history available yet.