CVE-2022-26595
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk50th percentile - higher than 50% of all known CVEs
Summary
Liferay Portal 7.3.7, 7.4.0, and 7.4.1, and Liferay DXP 7.2 fix pack 13 and 7.3 fix pack 2 do not properly check user permission when accessing a list of sites/groups. This allows remote authenticated users to view sites/groups via the user's site membership assignment UI.
Risk Assessment
The organization is exposed to unauthorized access to information about sites and groups, potentially leading to sensitive data leakage or confidentiality breaches.
Recommendation
It is recommended to immediately upgrade Liferay Portal to version 7.4.2 or later and Liferay DXP to the appropriate fix pack containing the patch.
Original NVD description (English source)
Liferay Portal 7.3.7, 7.4.0, and 7.4.1, and Liferay DXP 7.2 fix pack 13, and 7.3 fix pack 2 does not properly check user permission when accessing a list of sites/groups, which allows remote authenticated users to view sites/groups via the user's site membership assignment UI.