Lucene search

[email protected]CVE-2022-42126

HistoryNov 15, 2022 - 1:15 a.m.

CVE-2022-42126

2022-11-1501:15:00

NVD-CWE-noinfo

[email protected]

web.nvd.nist.gov

cve-2022-42126

asset libraries

liferay portal

liferay dxp

permissions

remote authentication

security vulnerability

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.4 Medium

AI Score

Confidence

High

4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

0.001 Low

EPSS

Percentile

46.6%

JSON

The Asset Libraries module in Liferay Portal 7.3.5 through 7.4.3.28, and Liferay DXP 7.3 before update 8, and DXP 7.4 before update 29 does not properly check permissions of asset libraries, which allows remote authenticated users to view asset libraries via the UI.

CPENameOperatorVersion
liferay:digital_experience_platformliferay digital experience platformeq7.3
liferay:digital_experience_platformliferay digital experience platformeq7.4
liferay:liferay_portalliferay liferay portallt7.4.3.29

CPE	Name	Operator	Version
liferay:digital_experience_platform	liferay digital experience platform	eq	7.3
liferay:digital_experience_platform	liferay digital experience platform	eq	7.4
liferay:liferay_portal	liferay liferay portal	lt	7.4.3.29

References

liferay.com

issues.liferay.com/browse/LPE-17593

portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42126

Social References

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.4 Medium

AI Score

Confidence

High

4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

0.001 Low

EPSS

Percentile

46.6%

JSON

Related for CVE-2022-42126

cvelist1 prion1 osv3 github1