CVE-2022-42126
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk45th percentile - higher than 45% of all known CVEs
Summary
The Asset Libraries module in Liferay Portal 7.3.5 through 7.4.3.28, and Liferay DXP 7.3 before update 8, and DXP 7.4 before update 29 does not properly check permissions of asset libraries, allowing remote authenticated users to view asset libraries via the UI.
Risk Assessment
The organization is at risk of unauthorized access to asset libraries, potentially leading to data leakage or security policy violations.
Recommendation
Immediately update Liferay Portal to version 7.4.3.29 or later, and Liferay DXP to the appropriate patched version (DXP 7.3 update 8 or DXP 7.4 update 29).
Original NVD description (English source)
The Asset Libraries module in Liferay Portal 7.3.5 through 7.4.3.28, and Liferay DXP 7.3 before update 8, and DXP 7.4 before update 29 does not properly check permissions of asset libraries, which allows remote authenticated users to view asset libraries via the UI.