PT-2023-24782 · Liferay · Liferay Dxp+1

4Rth4S · Published 2023-08-02 · Updated 2026-01-30 · CVE-2023-3426

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.4.3.81 through 7.4.3.85 Liferay DXP 7.4 update 81 through 85

Description The organization selector does not check user permission, allowing remote authenticated users to obtain a list of all organizations.

Recommendations For Liferay Portal versions 7.4.3.81 through 7.4.3.85, consider restricting access to the organization selector until a patch is available. For Liferay DXP 7.4 update 81 through 85, consider restricting access to the organization selector until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Weakness Enumeration

CWE-862

CWE-425

Related Identifiers

BIT-LIFERAY-2023-3426

CVE-2023-3426

GHSA-XPH3-VJCQ-G488

Affected Products

Liferay Dxp

Liferay Portal

References · 9

• https://osv.dev/vulnerability/GHSA-xph3-vjcq-g488 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-3426 · Security Note
• https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-3426 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-3426 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-liferay-2023-3426 · Vendor Advisory
• https://github.com/liferay/liferay-portal · Note
• https://github.com/liferay/liferay-portal/commit/b410f40233394d1d3d1076189befd4b33ba9fb47 · Note
• https://t.me/cveNotify/150458 · Telegram Post
• https://t.me/cibsecurity/67572 · Telegram Post