CVSS 3.1
4.3 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NCVE-2023-3426
Medium (4.3) in liferay. EPSS 0.6% chance of exploitation in the next 30 days. Fixed in com.liferay:com.liferay.organizations.item.selector.web 4.0.14.
The organization selector in Liferay Portal 7.4.3.81 through 7.4.3.85, and Liferay DXP 7.4 update 81 through 85 does not check user permission, which allows remote authenticated users to obtain a list of all organizations.
Severity
- EPSS
- 0.6% chance of exploitation in the next 30 days; higher than 47% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-862, CWE-425
- Published
- Modified
- Record from
- the NVD, synced
Affected
- liferay:digital_experience_platform
- liferay:liferay_portal
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-xph3-vjcq-g488 | Maven | com.liferay:com.liferay.organizations.item.selector.web | <4.0.14 | 4.0.14 |
| GHSA-xph3-vjcq-g488 | Maven | com.liferay.portal:release.dxp.bom | >=7.4.143.u81 <=7.4.143.u85 | no fix published |