cve.bz

CVE-2022-26595

4.3 mediumEPSS 0.7%

Medium (4.3) in liferay. EPSS 0.7% chance of exploitation in the next 30 days. Fixed in com.liferay.portal:release.portal.bom 7.4.2-ga3.

Liferay Portal 7.3.7, 7.4.0, and 7.4.1, and Liferay DXP 7.2 fix pack 13, and 7.3 fix pack 2 does not properly check user permission when accessing a list of sites/groups, which allows remote authenticated users to view sites/groups via the user's site membership assignment UI.

Severity

CVSS 3.1

4.3 medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
EPSS
0.7% chance of exploitation in the next 30 days; higher than 54% of CVEs (scores of 2026-10-31)
CWE
CWE-276
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-822f-jfpg-hg7hMavencom.liferay.portal:release.portal.bom7.3.7no fix published
GHSA-822f-jfpg-hg7hMavencom.liferay.portal:release.portal.bom>=7.4.0 <7.4.2-ga37.4.2-ga3
GHSA-822f-jfpg-hg7hMavencom.liferay.portal:release.dxp.bom>=7.2.0 <7.2.10.fp137.2.10.fp13
GHSA-822f-jfpg-hg7hMavencom.liferay.portal:release.dxp.bom>=7.3.0 <7.3.10.fp27.3.10.fp2
GHSA-822f-jfpg-hg7hMavencom.liferay:com.liferay.site.browser.web<6.0.56.0.5
GHSA-822f-jfpg-hg7hMavencom.liferay.portal:com.liferay.portal.impl<7.7.97.7.9

References

Check your stackJSON