CVE-2022-42126

Опубликовано: 15 нояб. 2022

Источник: nvd

CVSS3: 4.3

EPSS Низкий

Описание

The Asset Libraries module in Liferay Portal 7.3.5 through 7.4.3.28, and Liferay DXP 7.3 before update 8, and DXP 7.4 before update 29 does not properly check permissions of asset libraries, which allows remote authenticated users to view asset libraries via the UI.

Ссылки

http://liferay.com
Vendor Advisory
https://issues.liferay.com/browse/LPE-17593
Vendor Advisory
https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42126
Vendor Advisory
http://liferay.com
Vendor Advisory
https://issues.liferay.com/browse/LPE-17593
Vendor Advisory
https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42126
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:liferay:digital_experience_platform:7.3:-:*:*:*:*:*:*

cpe:2.3:a:liferay:digital_experience_platform:7.4:-:*:*:*:*:*:*

cpe:2.3:a:liferay:digital_experience_platform:7.4:update1:*:*:*:*:*:*

cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*

Версия от 7.3.5 (включая) до 7.4.3.29 (исключая)

EPSS

Процентиль: 35%

0.00144

Низкий

4.3 Medium

CVSS3

Дефекты

NVD-CWE-noinfo

CWE-284

Связанные уязвимости

GHSA-642h-mx8q-47p2