5.3

CVE-2022-42127 Friendly URL history accessible to unauthorized users

Description

The Friendly Url module in Liferay Portal 7.4.3.5 through 7.4.3.36 does not properly check user permission, which allows remote attackers to obtain the history of all friendly URLs that was assigned to a page.

Severity

5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

Affected Version(s)

  • Liferay Portal 7.4.3.5 - 7.4.3.36

Fixed Version(s)

Acknowledgments

This issue was reported by 4rth4s

Publication Date: 

October 19, 2022

Found a Bug?

If you have found, or think you have found a bug, help us to help you by letting us know!

Found a Security Vulnerability?

There's a different process available if you have a security issue to report...

Hall of Fame!

Raise your profile - report security vulnerabilities and enter the Hall of Fame!