PT-2022-26272 · Liferay · Liferay Portal+1

Published 2022-11-15 · Updated 2025-04-30 · CVE-2022-42126

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.3.5 through 7.4.3.28 Liferay DXP 7.3 before update 8 Liferay DXP 7.4 before update 29

Description The Asset Libraries module does not properly check permissions of asset libraries, allowing remote authenticated users to view asset libraries via the UI.

Recommendations For Liferay Portal versions 7.3.5 through 7.4.3.28, update to a version after 7.4.3.28 to resolve the issue. For Liferay DXP 7.3 before update 8, apply update 8 or later to fix the issue. For Liferay DXP 7.4 before update 29, apply update 29 or later to resolve the issue. As a temporary workaround, consider restricting access to the Asset Libraries module until a patch is available.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

CWE-280

Related Identifiers

BIT-LIFERAY-2022-42126

CVE-2022-42126

GHSA-642H-MX8Q-47P2

Affected Products

Liferay Dxp

Liferay Portal

References · 9

• https://osv.dev/vulnerability/GHSA-642h-mx8q-47p2 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-liferay-2022-42126 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-42126 · Vendor Advisory
• https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42126 · Vendor Advisory
• http://liferay.com · Vendor Advisory
• https://issues.liferay.com/browse/LPE-17593 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-42126 · Security Note
• https://t.me/cvenotify/120324 · Telegram Post
• https://t.me/cvenotify/37710 · Telegram Post