CVE-2022-42128

The Hypermedia REST APIs module in Liferay Portal 7.4.1 through 7.4.3.4, and Liferay DXP 7.4 GA does not properly check permissions, which allows remote attackers to obtain a WikiNode object via the WikiNodeResource.getSiteWikiNodeByExternalReferenceCode API.

Published: Nov 15, 2022
Updated: May 9, 2024
CVE: CVE-2022-42128
GHSA: GHSA-wgqm-qp44-cg6x
Severity: Medium
Exploit:

CVSS v3:

Severity: Medium
Score: 5.3
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CWEs:

CWE-276

Affected Software
References

Software	From	Fixed in
liferay / digital_experience_platform	7.4	7.4.x
liferay / liferay_portal	7.4.1	7.4.3.5
com.liferay.portal / release.portal.bom	7.4.1	7.4.3.5

http://liferay.com
https://issues.liferay.com/browse/LPE-17595
https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42128

Vulnerability Database

289,782

CVE-2022-42128