CVE-2022-42128
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk47th percentile - higher than 47% of all known CVEs
Summary
The Hypermedia REST APIs module in Liferay Portal 7.4.1 through 7.4.3.4 and Liferay DXP 7.4 GA does not properly check permissions, allowing remote attackers to obtain a WikiNode object via the WikiNodeResource.getSiteWikiNodeByExternalReferenceCode API.
Risk Assessment
The organization is at risk of unauthorized access to WikiNode data, potentially leading to leakage of confidential information or content integrity breaches.
Recommendation
Immediately update Liferay Portal to version 7.4.3.5 or later and Liferay DXP to a version containing the security patch.
Original NVD description (English source)
The Hypermedia REST APIs module in Liferay Portal 7.4.1 through 7.4.3.4, and Liferay DXP 7.4 GA does not properly check permissions, which allows remote attackers to obtain a WikiNode object via the WikiNodeResource.getSiteWikiNodeByExternalReferenceCode API.