What is GHSA-83qx-288m-72w4?

GHSA-83qx-288m-72w4 is a security advisory published by GitHub Security Advisories with Medium severity. Liferay Portal Missing Authorization vulnerability

Which CVE IDs does GHSA-83qx-288m-72w4 cover?

GHSA-83qx-288m-72w4 covers the following CVE IDs: CVE-2022-39975. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-83qx-288m-72w4?

GHSA-83qx-288m-72w4 has a CVSS v3 base score of 4.3, published by GitHub Security Advisories.

Which products are affected by GHSA-83qx-288m-72w4?

GHSA-83qx-288m-72w4 affects 1 product, including: maven/com.liferay.portal:release.portal.bom:\u003e= 7.3.3, \u003c 7.4.3.35.

GHSA-83qx-288m-72w4MediumCVSS 4.3

Liferay Portal Missing Authorization vulnerability

Vendor

GitHub Security Advisories

Published

September 23, 2022

Last Modified

January 31, 2023

🔗 CVE IDs covered (1)

CVE-2022-39975 →

📋 Description

The Layout module in Liferay Portal v7.3.3 through v7.4.3.34, and Liferay DXP 7.3 before update 10, and 7.4 before update 35 does not check user permission before showing the preview of a "Content Page" type page, allowing attackers to view unpublished "Content Page" pages via URL manipulation.

🎯 Affected products1

maven/com.liferay.portal:release.portal.bom:>= 7.3.3, < 7.4.3.35

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2022-39975
https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-39975
http://liferay.com
https://github.com/advisories/GHSA-83qx-288m-72w4