CVE-2022-26595
Description
Liferay Portal 7.3.7, 7.4.0, and 7.4.1, and Liferay DXP 7.2 fix pack 13, and 7.3 fix pack 2 does not properly check user permission when accessing a list of sites/groups, which allows remote authenticated users to view sites/groups via the users site membership assignment UI.
Risk Information
Base Score
4.3
MODERATE
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
EPSS Score
Exploitation Probability
0.112
Associated Vulnerability
| Vulnerability | OS Platform |
|---|---|
| Vulnerabilities CVE-2022-26595,CVE-2021-38269 are fixed in Liferay - release.dxp.bom 7.2.10 | Windows |
| Vulnerabilities CVE-2022-26595,CVE-2021-38267,CVE-2021-38269,CVE-2021-38268 are fixed in Liferay - release.dxp.bom 7.3.10 | Windows |
| Vulnerabilities CVE-2022-26595 are fixed in Liferay - release.portal.bom 7.4.2 | Windows |
| Vulnerabilities CVE-2022-26595 are affected in Liferay - release.portal.bom 7.3.7 | Windows |
| Vulnerabilities CVE-2022-26595 are fixed in Liferay - com.liferay.portal.impl 7.7.9 | Windows |
| Vulnerabilities CVE-2022-26595 are fixed in Liferay - com.liferay.site.browser.web 6.0.5 | Windows |
| Vulnerabilities CVE-2022-26595,CVE-2021-38269 are fixed in Liferay - release.dxp.bom for Linux 7.2.10 | Linux |
| Vulnerabilities CVE-2022-26595,CVE-2021-38267,CVE-2021-38269,CVE-2021-38268 are fixed in Liferay - release.dxp.bom for Linux 7.3.10 | Linux |
| Vulnerabilities CVE-2022-26595 are fixed in Liferay - release.portal.bom for Linux 7.4.2 | Linux |
| Vulnerabilities CVE-2022-26595 are affected in Liferay - release.portal.bom for Linux 7.3.7 | Linux |
| Vulnerabilities CVE-2022-26595 are fixed in Liferay - com.liferay.portal.impl for Linux 7.7.9 | Linux |
| Vulnerabilities CVE-2022-26595 are fixed in Liferay - com.liferay.site.browser.web for Linux 6.0.5 | Linux |
Patch Details
No records foundReferences
https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234