PT-2024-11698 · Liferay · Liferay Portal+1

Asaf Guterman · Published 2024-02-19 · Updated 2025-03-28 · CVE-2022-45320

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Liferay Portal versions prior to 7.4.3.16 Liferay DXP versions prior to 7.2 fix pack 19 Liferay DXP version 7.3 before update 6 Liferay DXP version 7.4 before update 16

Description The issue allows remote authenticated users to become the owner of a wiki page by editing the wiki page.

Recommendations For Liferay Portal version prior to 7.4.3.16, update to version 7.4.3.16 or later. For Liferay DXP version prior to 7.2 fix pack 19, update to 7.2 fix pack 19 or later. For Liferay DXP version 7.3 before update 6, apply update 6 or later. For Liferay DXP version 7.4 before update 16, apply update 16 or later.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2022-45320

GHSA-MC8M-4R3W-Q2HW

Affected Products

Liferay Dxp

Liferay Portal

References · 11

• https://osv.dev/vulnerability/GHSA-mc8m-4r3w-q2hw · Vendor Advisory
• https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2022-45320 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-45320 · Security Note
• https://osv.dev/vulnerability/CVE-2022-45320 · Vendor Advisory
• https://github.com/liferay/liferay-portal · Note
• https://github.com/liferay/liferay-portal/releases/tag/7.4.3.16-ga16 · Note
• https://t.me/cvenotify/111100 · Telegram Post
• https://t.me/cvenotify/116887 · Telegram Post
• https://twitter.com/CVEnew/status/1759809148991275022 · Twitter Post
• https://t.me/cvenotify/116235 · Telegram Post
• https://t.me/cvenotify/71938 · Telegram Post