What is GHSA-xph3-vjcq-g488?

GHSA-xph3-vjcq-g488 is a security advisory published by GitHub Security Advisories with Medium severity. Liferay Portal and Liferay DXP Organization Selector Does Not Check User Permissions

Which CVE IDs does GHSA-xph3-vjcq-g488 cover?

GHSA-xph3-vjcq-g488 covers the following CVE IDs: CVE-2023-3426. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-xph3-vjcq-g488?

GHSA-xph3-vjcq-g488 has a CVSS v3 base score of 4.3, published by GitHub Security Advisories.

Which products are affected by GHSA-xph3-vjcq-g488?

GHSA-xph3-vjcq-g488 affects 2 products, including: maven/com.liferay:com.liferay.organizations.item.selector.web:\u003c 4.0.14; maven/com.liferay.portal:release.dxp.bom:\u003e= 7.4.143.u81, \u003c= 7.4.143.u85.

GHSA-xph3-vjcq-g488MediumCVSS 4.3

Liferay Portal and Liferay DXP Organization Selector Does Not Check User Permissions

Vendor

GitHub Security Advisories

Published

August 2, 2023

Last Modified

August 8, 2025

🔗 CVE IDs covered (1)

CVE-2023-3426 →

📋 Description

The organization selector before 4.0.14 from Liferay Portal (7.4.3.81 through 7.4.3.85), and Liferay DXP 7.4 update 81 through 85 does not check user permission, which allows remote authenticated users to obtain a list of all organizations.

🎯 Affected products2

maven/com.liferay:com.liferay.organizations.item.selector.web:< 4.0.14
maven/com.liferay.portal:release.dxp.bom:>= 7.4.143.u81, <= 7.4.143.u85

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2023-3426
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-3426
https://github.com/liferay/liferay-portal/commit/b410f40233394d1d3d1076189befd4b33ba9fb47
https://github.com/advisories/GHSA-xph3-vjcq-g488