CVE-2023-3426
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
In Liferay Portal versions 7.4.3.81 to 7.4.3.85 and Liferay DXP 7.4 updates 81 to 85, the organization selector does not check user permissions, allowing remote authenticated users to obtain a list of all organizations.
Risk Assessment
The lack of permission verification may lead to the disclosure of sensitive information about organizations, posing a risk to data privacy and security.
Recommendation
It is recommended to update Liferay Portal and Liferay DXP to the latest version to fix this vulnerability and implement additional access control mechanisms.
Original NVD description (English source)
The organization selector in Liferay Portal 7.4.3.81 through 7.4.3.85, and Liferay DXP 7.4 update 81 through 85 does not check user permission, which allows remote authenticated users to obtain a list of all organizations.