CVE-2022-42127
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk47th percentile - higher than 47% of all known CVEs
Summary
The Friendly Url module in Liferay Portal 7.4.3.5 through 7.4.3.36 and Liferay DXP 7.4 update 1 through 36 does not properly check user permissions, allowing remote attackers to obtain the history of all friendly URLs assigned to a page.
Risk Assessment
The risk involves unauthorized access to sensitive page structure information, which could facilitate social engineering attacks or disclosure of non-public paths.
Recommendation
It is recommended to immediately upgrade Liferay Portal to version 7.4.3.37 or later, and Liferay DXP to version 7.4 update 37 or later.
Original NVD description (English source)
The Friendly Url module in Liferay Portal 7.4.3.5 through 7.4.3.36, and Liferay DXP 7.4 update 1 though 36 does not properly check user permissions, which allows remote attackers to obtain the history of all friendly URLs that was assigned to a page.