PT-2023-24782 · Liferay · Liferay Dxp+1

4Rth4S · Publicado 2023-08-02 · Atualizado 2026-01-30 · CVE-2023-3426

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.4.3.81 through 7.4.3.85 Liferay DXP 7.4 update 81 through 85

Description The organization selector does not check user permission, allowing remote authenticated users to obtain a list of all organizations.

Recommendations For Liferay Portal versions 7.4.3.81 through 7.4.3.85, consider restricting access to the organization selector until a patch is available. For Liferay DXP 7.4 update 81 through 85, consider restricting access to the organization selector until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Enumeração de Fraquezas

CWE-862

CWE-425

Identificadores relacionados

BIT-LIFERAY-2023-3426

CVE-2023-3426

GHSA-XPH3-VJCQ-G488

Produtos afetados

Liferay Dxp

Liferay Portal

Referências · 9

• https://github.com/liferay/liferay-portal · Nota
• https://github.com/liferay/liferay-portal/commit/b410f40233394d1d3d1076189befd4b33ba9fb47 · Nota
• https://osv.dev/vulnerability/GHSA-xph3-vjcq-g488 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-3426 · Nota de Segurança
• https://t.me/cveNotify/150458 · Publicação no Telegram
• https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-3426 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-3426 · Aviso do Fabricante
• https://t.me/cibsecurity/67572 · Publicação no Telegram
• https://osv.dev/vulnerability/BIT-liferay-2023-3426 · Aviso do Fabricante