Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

com.liferay:com.liferay.site.browser.web

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 4.3MavenPublished

    Liferay Portal and Liferay DXP fails to check permissions to view sites/groups

    CVE-2022-26595 · GHSA-822f-jfpg-hg7h

    Affected
    • Maven com.liferay:com.liferay.site.browser.web < 6.0.5
    Fixed in
    6.0.5· Partial vendor fix
    Issue
    Liferay Portal 7.3.7, 7.4.0, and 7.4.1, and Liferay DXP 7.2 fix pack 13, and 7.3 fix pack 2 does not properly check user permission when accessing a list of sites/groups, which allows remote authenticated users to view sites/groups via the user's site membership assignment UI.

    Recommended action: Upgrade to 6.0.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →